Security Advisory - Two JSON Injection Vulnerabilities in Some Huawei Servers

The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have two JSON injection vulnerabilities due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to obtain the management privilege of the system. (Vulnerability ID: HWPSIRT-2018-02050 and HWPSIRT-2018-02051)
The two vulnerabilities have been assigned two Common Vulnerabilities and Exposures (CVE) IDs: CVE-2018-7950 and CVE-2018-7951.
Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180530-02-server-en