ME906s-158 earlier than ME906S_Installer_13.1805.10.3 versions has a privilege elevation vulnerability.

published 2017-11-22 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-17147

cvss: 7.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits: 0; none known

ME906s-158 earlier than ME906S_Installer_13.1805.10.3 versions has a privilege elevation vulnerability. An attacker could exploit this vulnerability to modify the configuration information containing malicious files and trick users into executing the files, resulting in the execution of arbitrary code.

Patch / fix

fixed in 1

huawei me906s-158_firmware me906s_installer_13.1805.10.3

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.8	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

Huawei Technologies Co., Ltd. ME906s-158

Classification

Weakness

CWE-668 Exposure of Resource to Wrong Sphere

References

huawei.com /en/psirt/security-advisories/huawei-sa-20170927-01-me906s-en
vendor-advisory

Sources

CVE List CVE-2017-8185
NVD CVE-2017-8185

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary