CVE-2014-2271 cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls back to HTTP when the HTTPS connection to the registry fails, w...
HighCVSS 8.1
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and execute arbitrary Java code by leveraging a network position between the client and the registry to block HTTPS traffic.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wps office | = 5.3.1 | No fix listed |
| Huawei p2-6011 firmware | < v100r001c00b043 | v100r001c00b043 |
References
- www.huawei.com third-party-advisory
- www.securityfocus.com third-party-advisory vdb-entry
- exchange.xforce.ibmcloud.com third-party-advisory vdb-entry
- labs.f-secure.com third-party-advisory
- labs.f-secure.com third-party-advisory