TI-2017-01948 Aliases CVE-2017-2706 GHSA-hx9j-rfr3-8j4f

Path traversal in Huawei Mate 9

LOW 33CWE-22Published 2017-11-22 · Updated 2024-09-16

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Mate 9 smartphones with software MHA-AL00AC00B125 have a directory traversal vulnerability in Push module. Since the system does not verify the file name during decompression, system directories are traversed. It could be exploited to cause the attacker to replace files and impact the service.

Why it matters now

EPSS 0.00866 58th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Huawei	Mate 9	MHA-AL00AC00B125	—	No fix listed	CNA

Mate 9 VendorHuawei Affected MHA-AL00AC00B125 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:huawei:mate_9_firmware::::::::	up to mha-al00ac00b125	Vulnerable	Huawei
cpe:2.3:h:huawei:mate_9:-:::::::*	not specified by NVD	Running on	Huawei

cpe:2.3:o:huawei:mate_9_firmware:*:*:*:*:*:*:*:* Versions up to mha-al00ac00b125 Vulnerable ·Huawei
cpe:2.3:h:huawei:mate_9:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2017-2706
2026-10-03 Alias added: GHSA-hx9j-rfr3-8j4f

References

Advisory 1

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170712-01-push-en

TI-2017-11224 Memory corruption in Huawei Mate 10 CVSS 3.0HIGH 8.8
TI-2017-11229 Double free in Huawei Mate 9 CVSS 3.0HIGH 7.8
TI-2017-05717 Use after free in Huawei Mate 9, Mate 9 Pro CVSS 3.0HIGH 7.8
TI-2017-01958 Memory corruption in Huawei Mate 9 CVSS 3.0HIGH 7.8
TI-2017-01949 Mate 9 smartphones with software MHA-AL00AC00B125 have a privilege escalation… CVSS 3.0HIGH 7.1
TI-2017-01945 Phone Finder in versions earlier before MHA-AL00BC00B156,Versions earlier before… CVSS 3.0MEDIUM 6.8

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences