CVE-2022-37008

The recovery module has a vulnerability of bypassing the verification of an update package before use. Successful exploitation of this vulnerability may affect system stability.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://consumer.huawei.com/en/support/bulletin/2022/8/	Vendor Advisory
https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202208-0000001363876177	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:huawei:emui:11.0.0:::::::*
	cpe:2.3:o:huawei:emui:11.0.1:::::::*
	cpe:2.3:o:huawei:emui:12.0.0:::::::*
	cpe:2.3:o:huawei:harmonyos:2.0:::::::*
	cpe:2.3:o:huawei:magic_ui:4.0.0:::::::*

History

No history.

Information

Published : 2022-08-10 20:16

Updated : 2024-02-28 19:29

NVD link : CVE-2022-37008

Mitre link : CVE-2022-37008

CVE.ORG link : CVE-2022-37008

JSON object : View

Products Affected

huawei

harmonyos
emui
magic_ui

CWE

CWE-345

Insufficient Verification of Data Authenticity

{"id": "CVE-2022-37008", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-08-10T20:16:04.967", "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2022/8/", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}, {"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202208-0000001363876177", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "The recovery module has a vulnerability of bypassing the verification of an update package before use. Successful exploitation of this vulnerability may affect system stability."}, {"lang": "es", "value": "El m\u00f3dulo recovery presenta una vulnerabilidad de omisi\u00f3n de verificaci\u00f3n de un paquete de actualizaci\u00f3n antes de su uso. Una explotaci\u00f3n con \u00e9xito de esta vulnerabilidad puede afectar la estabilidad del sistema"}], "lastModified": "2022-08-15T17:58:26.997", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:emui:11.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B701EC6-8208-4D22-95A6-B07D471A8A8B"}, {"criteria": "cpe:2.3:o:huawei:emui:11.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "511F8CE2-C2B6-4A08-B992-49D9B75B8655"}, {"criteria": "cpe:2.3:o:huawei:emui:12.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A974CA73-84E8-480B-BB4C-4A81D0C985B2"}, {"criteria": "cpe:2.3:o:huawei:harmonyos:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3AD62E8B-CB4B-43A6-98E8-09A8A1A3505B"}, {"criteria": "cpe:2.3:o:huawei:magic_ui:4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6066FAB-23F5-4CB2-B89E-B00F8835AC39"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@huawei.com"}