CVE-2021-37124

Vulnerability

A path traversal vulnerability exists in Huawei PCManager, part of PC Smart Full Scene 11.1. The product fails to filter special characters in file paths, enabling an attacker to construct a path with traversal sequences (e.g., ../). This allows writing a file to an unintended directory. Affected version: PCManager 11.1.1.97. [1]

Exploitation

An attacker must be able to supply a crafted file path to the vulnerable component. The exact attack vector is not detailed in the advisory, but it likely requires local access or the ability to trigger file operations. By embedding path traversal sequences, the attacker can redirect the file write operation outside the intended directory. [1]

Impact

Successful exploitation permits the attacker to transport (write) a file to an arbitrary path on the system. This could lead to overwriting critical system files, placing malicious executables in startup directories, or other actions that may result in privilege escalation or arbitrary code execution. [1]

Mitigation

Huawei has released a fix in PCManager 11.1.5.3. Users should update to this version. No workarounds are provided. The security advisory was published on 2021-10-08. [1]