CVE-2014-8358

HIGH

Huawei EC156, EC176, and EC177 Firmware - Untrusted Search Path via Mobile Partner Directory

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-8358.

AI-analyzed exploit summary The vulnerability involves improper file permissions on the 'du Mobile Broadband.exe' binary, allowing any user to replace it with a malicious binary. Upon system reboot, the replaced binary executes with SYSTEM privileges, leading to local privilege escalation.

Description

Huawei EC156, EC176, and EC177 USB Modem products with software before UTPS-V200R003B015D02SP07C1014 (23.015.02.07.1014) and before V200R003B015D02SP08C1014 (23.015.02.08.1014) use a weak ACL for the "Mobile Partner" directory, which allows remote attackers to gain SYSTEM privileges by compromising a low privilege account and modifying Mobile Partner.exe.

Exploits (1)

exploitdb WRITEUP
localwindows
https://www.exploit-db.com/exploits/30477

The vulnerability involves improper file permissions on the 'du Mobile Broadband.exe' binary, allowing any user to replace it with a malicious binary. Upon system reboot, the replaced binary executes with SYSTEM privileges, leading to local privilege escalation.

Classification
Writeup 90%
Attack Type
Lpe
Complexity
Trivial
Reliability
Reliable
Target: Huawei Technologies du Mobile Broadband 16.002.03.16.124
No auth needed
Prerequisites: Local access to the affected system · Ability to replace the executable file
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (3)

Core 3
Core References
Issue Tracking, Vendor Advisory x_refsource_confirm
http://www.huawei.com/us/psirt/security-advisories/2014/hw-376152
Issue Tracking, Third Party Advisory, VDB Entry x_refsource_misc
https://packetstormsecurity.com/files/128767/Huawei-Mobile-Partner-DLL-Hijacking.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/70672

Scores

CVSS v3 7.8
EPSS 0.0502
EPSS Percentile 91.1%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-426
Status published
Products (3)
huawei/ec156_firmware v200r003b009d05sp03c1014
huawei/ec176_firmware v200r003b009d05sp03c1014
huawei/ec177_firmware v200r003b009d05sp03c1014
Published Dec 11, 2017
Tracked Since Feb 18, 2026