CVE-2017-8177 Security feature bypass in HiWallet
Attackers can bypass signature verification to hijack the HiWallet APK, enabling malicious code execution and potential account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-8177?
CVE-2017-8177 is a medium-severity vulnerability in Huawei Technologies Co., Ltd. HiWallet, published on 22 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Huawei APP HiWallet earlier than 5.0.3.100 versions do not support signature verification for APK file. An attacker could exploit this vulnerability to hijack the APK and upload modified APK file. Successful exploit could lead to the APP is hijacking.
Weakness: CWE-347
Which versions are affected by CVE-2017-8177?
It affects 1 product.
Products include Huawei Hiwallet.
How do I fix CVE-2017-8177?
No fix has been published for CVE-2017-8177 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-8177 being exploited?
There is no known exploitation of CVE-2017-8177 in the wild and no public exploit code.
Other vulnerabilities in Huawei Technologies Co., Ltd. HiWallet
Sources
Also known as GHSA-pxvh-phh5-pgf4.