Lucene search

Huawei TechnologiesHUAWEI-SA-20180509-01-BYPASS

HistoryMay 09, 2018 - 12:00 a.m.

Security Advisory - Authentication Bypass Vulnerability in Huawei iBMC Products

2018-05-0900:00:00

Huawei Technologies

www.huawei.com

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

68.7%

JSON

There is an authentication bypass vulnerability in Huawei iBMC products. A remote attacker with low privilege may craft specific messages to upload authentication certificate to the affected products. Due to improper validation of the upload authority, successful exploit may cause privilege elevation. (Vulnerability ID: HWPSIRT-2018-02055)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2018-7941.

Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180509-01-bypass-en

Affected configurations

Vulners

Node

huaweifusionserver_ch121_v3Matchch121

huaweifusionserver_ch121_v3Matchv3

huaweifusionserver_ch121_v3Matchv100r001c00

huaweich121l v5Matchch121l

huaweich121l v5Matchv3

huaweich121l v5Matchv100r001c00

huaweich140Matchch140

huaweich140Matchv3

huaweich140Matchv100r001c00

huaweifusionserver_ch220_v3Matchch140l

huaweifusionserver_ch220_v3Matchv3

huaweifusionserver_ch220_v3Matchv100r001c00

huaweifusionserver_ch220_v3Matchch220

huaweifusionserver_ch220_v3Matchv3

huaweifusionserver_ch220_v3Matchv100r001c00

huaweifusionserver_ch222_v3Matchch222

huaweifusionserver_ch222_v3Matchv3

huaweifusionserver_ch222_v3Matchv100r001c00

huawei●ch242Matchch242

huawei●ch242Matchv3

huawei●ch242Matchv100r001c00

huaweifusionserver_rh1288_v3Matchrh1288

huaweifusionserver_rh1288_v3Matchv3

huaweifusionserver_rh1288_v3Matchv100r003c00

huaweifusionserver_rh2288_v3Matchrh2288

huaweifusionserver_rh2288_v3Matchv3

huaweifusionserver_rh2288_v3Matchv100r003c00

huaweifusionserver_rh2288h_v3Matchrh2288h

huaweifusionserver_rh2288h_v3Matchv3

huaweifusionserver_rh2288h_v3Matchv100r003c00

huaweifusionserver_ch220_v3Matchxh310

huaweifusionserver_ch220_v3Matchv3

huaweifusionserver_ch220_v3Matchv100r003c00

huaweixh321_v5Matchxh321

huaweixh321_v5Matchv3

huaweixh321_v5Matchv100r003c00

huaweixh620Matchxh620

huaweixh620Matchv3

huaweixh620Matchv100r003c00

huaweifusionserver_ch121_v3Matchch121

huaweifusionserver_ch121_v3Matchv5

huaweifusionserver_ch121_v3Matchv100r001c00

huaweich121l_v5Matchch121l

huaweich121l_v5Matchv5

huaweich121l_v5Matchv100r001c00

huaweich242_v5Matchch242

huaweich242_v5Matchv5

huaweich242_v5Matchv100r001c00

huawei1288h_v5Match1288h

huawei1288h_v5Matchv5

huawei1288h_v5Matchv100r005c00

huawei2288h_v5Match2288h

huawei2288h_v5Matchv5

huawei2288h_v5Matchv100r005c00

huawei2488_v5Match2488

huawei2488_v5Matchv5

huawei2488_v5Matchv100r005c00

huaweixh321_v5Matchxh321

huaweixh321_v5Matchv5

huaweixh321_v5Matchv100r005c00

CPENameOperatorVersion
ch121 v3eqCH121
ch121 v3eqV3
ch121 v3eqV100R001C00
ch121l v3eqCH121L
ch121l v3eqV3
ch121l v3eqV100R001C00
ch140 v3eqCH140
ch140 v3eqV3
ch140 v3eqV100R001C00
ch140l v3eqCH140L

Name	Operator	Version
ch121 v3	eq	CH121
ch121 v3	eq	V3
ch121 v3	eq	V100R001C00
ch121l v3	eq	CH121L
ch121l v3	eq	V3
ch121l v3	eq	V100R001C00
ch140 v3	eq	CH140
ch140 v3	eq	V3
ch140 v3	eq	V100R001C00
ch140l v3	eq	CH140L

Rows per page:

1-10 of 601

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

68.7%

JSON

Related for HUAWEI-SA-20180509-01-BYPASS