Security Advisory - Command Injection Vulnerability in ManageOne Product

There has a command injection vulnerability in ManageOne Product. An attacker with high privileges may exploit this vulnerability through some operations on the plug-in component. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject commands to the target device. (Vulnerability ID: HWPSIRT-2020-56397)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9115.

Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201125-01-commandinjection-en