QwikSec

Security Database

CVE

CWE

Training

CVE-2016-5821

Published: Jul 13, 2016

Modified: Aug 6, 2024

PUBLISHED

Description

Huawei HiSuite before 4.0.4.204_ove (Out of China) and before 4.0.4.301 (China) use a weak ACL (FILE_WRITE_DATA for BUILTIN\Users) for the HiSuite service directory, which allows local users to gain SYSTEM privileges via a Trojan horse (1) SspiCli.dll or (2) USERENV.dll file or possibly other unspecified DLL files.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://labs.bluefrostsecurity.de/advisories/bfs-sa-2016-003/

x_refsource_MISC

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160624-01-hisuite-en

x_refsource_CONFIRM

20160629 BFS-SA-2016-003: Huawei HiSuite Insecure Service Directory ACLs

mailing-list

x_refsource_BUGTRAQ

http://packetstormsecurity.com/files/137733/Huawei-HiSuite-For-Windows-4.0.3.301-Privilege-Escalation.html

x_refsource_MISC

vdb-entry

x_refsource_BID

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.