CVE-2021-40045: Huawei Recovery Update Zip Signature Verification Bypass

Summary In this advisory we are disclosing a signature verification bypass vulnerability in the Huawei recovery mode. The vulnerability can be used not only to apply unauthentic firmware updates but also to achieve arbitrary code execution in the recovery mode. Combining this advisory with the vulnerability detailed in CVE-2021-40055, an attacker can achieve remote code execution without user interraction from the position of a network MITM.
The vulnerability was fixed in February 2022.
Vulnerability Details Huawei devices - both those …

bypass cve huawei recovery signature update verification zip