CVE-2017-8177

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-11-22 · updated 2026-06-17
Weakness: CWE-347

Description

Huawei APP HiWallet earlier than 5.0.3.100 versions do not support signature verification for APK file. An attacker could exploit this vulnerability to hijack the APK and upload modified APK file. Successful exploit could lead to the APP is hijacking.

Affected products

Huawei Technologies Co., Ltd. HiWallet: before 5.0.3.100 — fixed in 5.0.3.100

How to fix

Upgrade to a fixed version: Huawei Technologies Co., Ltd. HiWallet 5.0.3.100. Check the vendor advisory for mitigations.

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170816-01-app-en
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170816-01-app-en

Get alerted when CVE-2017-8177 or the next vulnerability affects your stack