CVE-2020-1817

Vulnerability

Huawei PCManager versions earlier than 10.0.1.36 contain a privilege escalation vulnerability (CVE-2020-1817). The bug stems from improper permission management of specific files, allowing a local attacker with low privileges to access or modify files that should be restricted [1].

Exploitation

To exploit this flaw, an attacker must have local access to the system with low privileges. By injecting commands through the improperly permissioned files, the attacker can escalate their privileges to a higher level. No user interaction beyond the attacker's own actions is required [1].

Impact

Successful exploitation leads to privilege escalation, meaning the attacker can gain higher system privileges than originally granted. This could allow the attacker to perform actions such as modifying system files, executing arbitrary code with elevated rights, or compromising other user accounts [1].

Mitigation

Huawei released software update version 10.0.1.36 for PCManager to fix this vulnerability. Users should upgrade to this version or later. The security advisory was published on April 29, 2020 [1]. No other workarounds are mentioned in the available references.