A privilege escalation flaw in Huawei Themes affects unpatched versions of the Honor 7 smartphone.
A privilege escalation flaw in Huawei Themes affects unpatched versions of the Honor 7 smartphone.

Huawei Technologies has released a new software update that patches a privilege escalation vulnerability in its Huawei Themes app that could ultimately result in arbitrary code execution.

Officially designated CVE-2017-2699, the bug is the result of a lack of theme pack check, according to a company vulnerability advisory. Attackers can exploit this flaw by uploading theme packs that contain malicious files and then tricking users into installing them.

Discovered by Wu Huiyu (aka Nicky) from the Security Platform Department at China-based Internet company Tencent, the vulnerability exists in the Honor 7 smartphone (versions prior to PLK-UL00C17B385) and Mate 8 smartphone (versions prior to CRR-L09C432B380).