CVE-2018-7926 Missing authorization in Huawei Watch 2
An attacker with a bound Huawei ID can bypass permission checks to modify data on the Huawei Watch 2.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7926?
CVE-2018-7926 is a medium-severity missing authorization vulnerability in Huawei Watch 2, published on 13 Nov 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Huawei Watch 2 with versions and earlier than OWDD.180707.001.E1 have an improper authorization vulnerability. Due to improper permission configuration for specific operations, an attacker who obtained the Huawei ID bound to the watch can bypass permission verification to perform specific operations and modify some data on the watch.
Weakness: CWE-863
Which versions are affected by CVE-2018-7926?
It affects 1 product.
Products include Huawei Watch 2 Firmware.
How do I fix CVE-2018-7926?
No fix has been published for CVE-2018-7926 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-7926 being exploited?
There is no known exploitation of CVE-2018-7926 in the wild and no public exploit code.
Sources
Also known as GHSA-22qq-pvp9-wmv5.