This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy (update in May 2018) >

Security Advisory-File Upload Vulnerability on Huawei Honor Cube Wireless Router WS860s

  • SA No:Huawei-SA-20141114-01-WS860s
  • Initial Release Date: Nov 14, 2014
  • Last Release Date: Nov 29, 2014

Huawei Honor Cube wireless router WS860s supports the file upload function. It allows users to access its files through the web page. As the device is unable to verify every type of file to be uploaded and does not strictly restrict the file access path through the web page, attackers may upload malicious files to the device and execute them, resulting in information leaks and file tampering (Vulnerability ID: HWPSIRT-2014-0946).

This Vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2014-9134

Product Name

Affected Version

Resolved Product and Version

WS860s

V100R001C02B219 and earlier

V100R001C02B222

Attackers can obtain the device information, tamper files on the device, and make the device broken down.

The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).

Base Score: 5.4 (AV:A/AC:M/Au:N/C:P/I:P/A:P)

Temporal Score: 4.5 (E:F/RL:O/RC:C)

1.Prerequisite:

Must access the device through a LAN port or using Wi-Fi.

2.Attacking procedure:

Access the device through a LAN port or using Wi-Fi, use the CLI tool on the client to send specific packets to upload a malicious file to an executable directory on the device, and access and execute the file through the web page to obtain the device information, tamper files on the device, or even make the device break down.
Customers should contact Huawei TAC (Huawei Technical Assistance Center) to request the upgrades. For TAC contact information, please refer to Huawei worldwide website at http://www.huawei.com/en/security/psirt/report-vulnerabilities/index.htm.


This vulnerability was found by Livers. Huawei PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

For security problems about Huawei products and solutions, please contactPSIRT@huawei.com.

For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.


2014-11-29 V1.1 UPDATED Added the CVE ID

2014-11-14 V1.0 INITIAL

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.


Complete information for providing feedback on security vulnerability of Huawei products, getting support for Huawei security incident response services, and obtaining Huawei security vulnerability information, is available on Huawei's worldwide website at http://www.huawei.com/en/security/psirt/.