Security Advisory - Hardcoded SSH Key Vulnerability in Some Huawei Storage Products

Some Huawei storage products have a hardcoded SSH key vulnerability. Different nodes of the devices use SSH to encrypt communication data and authenticate each other based on public and private keys. Since the SSH public and private keys are hardcoded, an attacker may obtain the keys and log in to such a device through SSH. (Vulnerability ID: HWPSIRT-2016-05005)

This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2016-8754.
Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161017-01-storage-en