CVE-2017-8153

Severity: high (CVSS 7.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-11-22 · updated 2026-06-17
Weakness: CWE-275

Description

Huawei VMall (for Android) with the versions before 1.5.8.5 have a privilege elevation vulnerability due to improper design. An attacker can trick users into installing a malicious app which can send out HTTP requests and execute JavaScript code in web pages without obtaining the Internet access permission. Successful exploit could lead to resource occupation or information leak.

Affected products

Huawei Technologies Co., Ltd. Vmall: before 1.5.8.5 — fixed in 1.5.8.5

How to fix

Upgrade to a fixed version: Huawei Technologies Co., Ltd. Vmall 1.5.8.5. Check the vendor advisory for mitigations.

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170901-01-smartphone-en
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170901-01-smartphone-en

Get alerted when CVE-2017-8153 or the next vulnerability affects your stack