Security Advisory - DLL Hijacking Vulnerability on Huawei UTPS

Huawei UTPS software runs on USB modem products to manage data cards. It provides data card setting, dial-up setting, message sending and receiving, and contacts management functions.

UTPS contains a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by UTPS improperly. And it allows an attacker to load this DLL file of the attacker’s choosing that could execute arbitrary code. (Vulnerability ID: HWPSIRT-2016-02009)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2016-2780.

Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160302-01-utps-en