Details of VAR-201606-0051

ID

VAR-201606-0051

CVE

CVE-2016-4086

TITLE

Huawei HiSuite Vulnerable to arbitrary application installation on connected phones

Trust: 0.8

sources: JVNDB: JVNDB-2016-003440

DESCRIPTION

Huawei HiSuite (In China) before 4.0.4.301 and (Out of China) before 4.0.4.204_ove allows remote attackers to install arbitrary apps on a connected phone via unspecified vectors. Huawei HiSuite is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. Huawei HiSuite is a set of mobile phone assistant software for PCs developed by China Huawei (Huawei). There are security vulnerabilities in Huawei HiSuite. The following versions are affected: Huawei HiSuite version 2.3.15, version 2.3.28, version 2.3.35, version 2.3.42, version 2.3.50, version 2.3.55.0 (domestic), version 2.3.55.1 (foreign)

Trust: 1.98

sources: NVD: CVE-2016-4086 // JVNDB: JVNDB-2016-003440 // BID: 92622 // VULHUB: VHN-92905

AFFECTED PRODUCTS

vendor:	huawei	model:	hisuite	scope:	eq	version:	2.3.50	Trust: 1.9
vendor:	huawei	model:	hisuite	scope:	eq	version:	2.3.42	Trust: 1.9
vendor:	huawei	model:	hisuite	scope:	eq	version:	2.3.35	Trust: 1.9
vendor:	huawei	model:	hisuite	scope:	eq	version:	2.3.28	Trust: 1.9
vendor:	huawei	model:	hisuite	scope:	eq	version:	2.3.15	Trust: 1.9
vendor:	huawei	model:	hisuite	scope:	eq	version:	2.3.55.1	Trust: 1.9
vendor:	huawei	model:	hisuite	scope:	eq	version:	2.3.55	Trust: 1.6
vendor:	huawei	model:	hisuite	scope:	lt	version:	4.0.4.204_ove (out of china)	Trust: 0.8
vendor:	huawei	model:	hisuite	scope:	lt	version:	4.0.4.301 (in china)	Trust: 0.8
vendor:	huawei	model:	hisuite	scope:	eq	version:	2.3.55.0	Trust: 0.3
vendor:	huawei	model:	hisuite	scope:	ne	version:	4.0.4.301	Trust: 0.3
vendor:	huawei	model:	hisuite 4.0.4.204 ove	scope:	ne	version:	-	Trust: 0.3

sources: BID: 92622 // JVNDB: JVNDB-2016-003440 // NVD: CVE-2016-4086 // CNNVD: CNNVD-201606-665

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2016-4086
value:	MEDIUM
Trust: 1.8
CNNVD:	CNNVD-201606-665
value:	LOW
Trust: 0.6
VULHUB:	VHN-92905
value:	LOW
Trust: 0.1

NVD:
severity:	LOW
baseScore:	2.9
vectorString:	AV:A/AC:M/AU:N/C:N/I:P/A:N
accessVector:	ADJACENT_NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	5.5
impactScore:	2.9
acInsufInfo:	FALSE
obtainAllPrivilege:	FALSE
obtainUserPrivilege:	FALSE
obtainOtherPrivilege:	FALSE
userInteractionRequired:	FALSE
version:	2.0
Trust: 1.0
NVD:	CVE-2016-4086
severity:	LOW
baseScore:	2.9
vectorString:	AV:A/AC:M/AU:N/C:N/I:P/A:N
accessVector:	ADJACENT NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
VULHUB:	VHN-92905
severity:	LOW
baseScore:	2.9
vectorString:	AV:A/AC:M/AU:N/C:N/I:P/A:N
accessVector:	ADJACENT_NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	5.5
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

NVD:
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	ADJACENT_NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	1.6
impactScore:	3.6
version:	3.0
Trust: 1.0
NVD:	CVE-2016-4086
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	ADJACENT NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-92905 // JVNDB: JVNDB-2016-003440 // NVD: CVE-2016-4086 // CNNVD: CNNVD-201606-665

PROBLEMTYPE DATA

problemtype:

NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2016-4086

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201606-665

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201606-665

CONFIGURATIONS

sources: NVD: CVE-2016-4086

PATCH

title:	huawei-sa-20160422-01-hisuite	url:	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160422-01-hisuite-en	Trust: 0.8
title:	Huawei HiSuite Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=62574	Trust: 0.6

sources: JVNDB: JVNDB-2016-003440 // CNNVD: CNNVD-201606-665

EXTERNAL IDS

db:	NVD	id:	CVE-2016-4086	Trust: 2.8
db:	BID	id:	92622	Trust: 1.4
db:	JVNDB	id:	JVNDB-2016-003440	Trust: 0.8
db:	CNNVD	id:	CNNVD-201606-665	Trust: 0.7
db:	VULHUB	id:	VHN-92905	Trust: 0.1

sources: VULHUB: VHN-92905 // BID: 92622 // JVNDB: JVNDB-2016-003440 // NVD: CVE-2016-4086 // CNNVD: CNNVD-201606-665

REFERENCES

url:	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160422-01-hisuite-en	Trust: 1.7
url:	http://www.securityfocus.com/bid/92622	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-4086	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-4086	Trust: 0.8
url:	http://www.huawei.com	Trust: 0.3
url:	http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160422-01-hisuite-en	Trust: 0.3

sources: VULHUB: VHN-92905 // BID: 92622 // JVNDB: JVNDB-2016-003440 // NVD: CVE-2016-4086 // CNNVD: CNNVD-201606-665

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 92622

SOURCES

db:	VULHUB	id:	VHN-92905
db:	BID	id:	92622
db:	JVNDB	id:	JVNDB-2016-003440
db:	NVD	id:	CVE-2016-4086
db:	CNNVD	id:	CNNVD-201606-665

LAST UPDATE DATE

2023-12-18T13:09:03.468000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-92905	date:	2016-11-28T00:00:00
db:	BID	id:	92622	date:	2016-08-24T00:00:00
db:	JVNDB	id:	JVNDB-2016-003440	date:	2016-07-07T00:00:00
db:	NVD	id:	CVE-2016-4086	date:	2016-11-28T20:14:58.840
db:	CNNVD	id:	CNNVD-201606-665	date:	2016-07-01T00:00:00

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-92905	date:	2016-06-30T00:00:00
db:	BID	id:	92622	date:	2016-08-24T00:00:00
db:	JVNDB	id:	JVNDB-2016-003440	date:	2016-07-07T00:00:00
db:	NVD	id:	CVE-2016-4086	date:	2016-06-30T16:59:02.507
db:	CNNVD	id:	CNNVD-201606-665	date:	2016-06-30T00:00:00