Read the docs
TI-2017-12683 Aliases CVE-2017-17309GHSA-xvw5-c4h4-r2rh

Path traversal in Huawei HG255s-10

Priority MEDIUM 43CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Huawei HG255s-10 V100R001C163B025SP02 has a path traversal vulnerability due to insufficient validation of the received HTTP requests, a remote attacker may access the local files on the device without authentication.

Why it matters now

EPSS 0.073 94th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HuaweiHG255s-10V100R001C163B025SP02—No fix listedCNA
  • HG255s-10 VendorHuawei Affected V100R001C163B025SP02 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:huawei:hg255s-10_firmware:v100r001c163b025sp02:*:*:*:*:*:*:*v100r001c163b025sp02VulnerableHuawei
cpe:2.3:h:huawei:hg255s-10:*:*:*:*:*:*:*:*all versionsRunning onHuawei
  • cpe:2.3:o:huawei:hg255s-10_firmware:v100r001c163b025sp02:*:*:*:*:*:*:* Versions v100r001c163b025sp02 Vulnerable ·Huawei
  • cpe:2.3:h:huawei:hg255s-10:*:*:*:*:*:*:*:* Versions all versions Running on ·Huawei

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-17309
  2. 2026-10-03 Alias added: GHSA-xvw5-c4h4-r2rh

References

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences