Read the docs
TI-2023-29044 Aliases CVE-2023-52711

Improper access control in Huawei CurieM-WFG9B

Priority LOW 35CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Denial of service
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284 and CWE-401.

Summary

Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. The first issue can be leveraged to bypass the protections that have been put in place by previous UEFI phases to prevent direct access to the SPI flash. The second issue can be used to both leak and corrupt SMM memory thus potentially leading code execution in SMM

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00115 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HuaweiCurieM-WFG9BCurieM-WFG9B BIOS 2.28—No fix listedCNA
  • CurieM-WFG9B VendorHuawei Affected CurieM-WFG9B BIOS 2.28 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:huawei:curiem-wfg9b_firmware:curiem-wfg9b_bios_2.28:*:*:*:*:*:*:*curiem-wfg9b_bios_2.28VulnerableHuawei
cpe:2.3:h:huawei:curiem-wfg9b:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
  • cpe:2.3:o:huawei:curiem-wfg9b_firmware:curiem-wfg9b_bios_2.28:*:*:*:*:*:*:* Versions curiem-wfg9b_bios_2.28 Vulnerable ·Huawei
  • cpe:2.3:h:huawei:curiem-wfg9b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-52711

References

Advisory 1

  • TI-2023-29043 Improper check for unusual conditions in Huawei CurieM-WFG9B CVSS 3.1HIGH 7.8
  • TI-2023-28891 Memory corruption in Huawei CurieM-WFG9B CVSS 3.1HIGH 7.8
  • TI-2023-28890 Out-of-bounds write in Huawei CurieM-WFG9B CVSS 3.1HIGH 7.8
  • TI-2023-29045 Improper access control in Huawei CurieM-WFG9B CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences