CVE-2018-7933

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-10 · updated 2026-06-17
Weakness: CWE-22

Description

Huawei home gateway products HiRouter-CD20 and WS5200 with the versions before HiRouter-CD20-10 1.9.6 and the versions before WS5200-10 1.9.6 have a path traversal vulnerability. Due to the lack of validation while these home gateway products install APK plugins, an attacker tricks a user into installing a malicious APK plugin, and plugin can overwrite arbitrary file of devices. Successful exploit may result in arbitrary code execution or privilege escalation.

Affected products

Huawei Hirouter-Cd20 Firmware: before hirouter-cd20-10_1.9.6 — fixed in hirouter-cd20-10_1.9.6
Huawei Ws5200 Firmware: before ws5200-10_1.9.6 — fixed in ws5200-10_1.9.6

How to fix

Upgrade to a fixed version: Huawei Hirouter-Cd20 Firmware hirouter-cd20-10_1.9.6; Huawei Ws5200 Firmware ws5200-10_1.9.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-7933 or the next vulnerability affects your stack