CVE-2019-5237

Vulnerability

A code execution vulnerability exists in Huawei PCManager software versions before 9.0.1.66 (Oversea) and before 9.0.1.70 (China) [1]. The vulnerability can be exploited to execute arbitrary code on the affected system. The exact nature of the flaw is not detailed in the advisory, but it enables code execution and read/write operations.

Exploitation

The advisory does not provide specific exploitation requirements, such as authentication level or network position [1]. It is assumed that an attacker may need to convince a user to perform an action or have some level of access to trigger the vulnerability.

Impact

Successful exploitation allows an attacker to execute arbitrary code and read/write information on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability [1].

Mitigation

Huawei has released software updates to fix these vulnerabilities. The resolved product version is PCManager 9.1.3.33 for both Oversea and China regions [1]. Users are advised to update to the latest version. No workarounds are provided.