Medium severity · published Dec 22, 2017
CVE-2017-15310
Huawei iReader app before 8.0.2.301 has an arbitrary file deletion vulnerability due to the lack of input validation
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
Huawei iReader app before 8.0.2.301 has an arbitrary file deletion vulnerability due to the lack of input validation. An attacker can exploit this vulnerability to delete specific files from the SD card.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IR
iReader · Huawei Technologies Co., Ltd.
before 8.0.2.301 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-15310
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-15310
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171120-01-hwreader-en
More from iReader
8.8
CVE-2017-15308
Huawei iReader app before 8.0.2.301 has an input validation vulnerability due to insufficient validation on the URL used for loading network data
7.1
CVE-2017-15309
Huawei iReader app before 8.0.2.301 has a path traversal vulnerability due to insufficient validation on file storage paths