Unrestricted file upload in Huawei VCM5010
Priority MEDIUM 40CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-434.
Summary
VCM5010 with software versions earlier before V100R002C50SPC100 has an arbitrary file upload vulnerability. The software does not validate the files that uploaded. An authenticated attacker could upload arbitrary files to the system.
Why it matters now
EPSS 0.00884 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Huawei | VCM5010 | Versions earlier before V100R002C50SPC100 | — | No fix listed | CNA |
- VCM5010 VendorHuawei Affected Versions earlier before V100R002C50SPC100 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-2737
- 2026-10-03 Alias added: GHSA-9wx5-w654-3m84
References
More Huawei Vcm5010 Firmware vulnerabilities
- TI-2017-01980 Improper authentication in Huawei VCM5010 CVSS 3.0CRITICAL 9.8
- TI-2015-06859 Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly… CVSS 3.0HIGH 8.8
- TI-2017-01978 Command injection in Huawei VCM5010 CVSS 3.0HIGH 7.2
Sources
- CVE-2017-2737 · CVE Program
- CVE-2017-2737 · NVD
- FIRST EPSS
- GHSA-9wx5-w654-3m84 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences