CVE-2017-8137 Other in HedEx Lite

High 7.8 Published 22 Nov 2017 Updated 17 Sep 2024

An attacker can execute arbitrary code by exploiting a DLL hijacking vulnerability in Huawei HedEx Lite caused by relative path loading.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2017-8137?

CVE-2017-8137 is a high-severity vulnerability in Huawei Technologies Co., Ltd. HedEx Lite, published on 22 Nov 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

HedEx Earlier than V200R006C00 versions has a dynamic link library (DLL) hijacking vulnerability due to calling the DDL file by accessing a relative path. An attacker could exploit this vulnerability to tamper with the DLL file, leading to DLL hijacking.

Weakness: CWE-426

Which versions are affected by CVE-2017-8137?

It affects 1 product.

Products include Huawei Hedex Lite.

How do I fix CVE-2017-8137?

No fix has been published for CVE-2017-8137 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-8137 being exploited?

There is no known exploitation of CVE-2017-8137 in the wild and no public exploit code.

Sources

Also known as GHSA-m7mx-932r-5pm4.