Lucene search

Huawei TechnologiesHUAWEI-SA-20200102-01-CREDENTIAL

HistoryJan 02, 2020 - 12:00 a.m.

Security Advisory - Improper Credentials Management Vulnerability in Some Products

2020-01-0200:00:00

Huawei Technologies

www.huawei.com

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS

0.002

Percentile

53.8%

JSON

There is an improper credentials management vulnerability in some products. The software does not properly manage certain credential, successful exploit could cause information disclosure or damage, and impact the confidentiality or integrity. (Vulnerability ID: HWPSIRT-2018-12263)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-1871.

Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200102-01-credential-en

Affected configurations

Vulners

Node

huaweiusg9500_firmwareMatchv500r001c30spc100

huaweiusg9500_firmwareMatchv500r001c30spc200

huaweiusg9500_firmwareMatchv500r001c30spc600

huaweiusg9500_firmwareMatchv500r001c60spc500

huaweiusg9500_firmwareMatchv500r005c00spc100

huaweiusg9500_firmwareMatchv500r005c00spc200

VendorProductVersionCPE
huaweiusg9500_firmwarev500r001c30spc100cpe:2.3:o:huawei:usg9500_firmware:v500r001c30spc100:*:*:*:*:*:*:*
huaweiusg9500_firmwarev500r001c30spc200cpe:2.3:o:huawei:usg9500_firmware:v500r001c30spc200:*:*:*:*:*:*:*
huaweiusg9500_firmwarev500r001c30spc600cpe:2.3:o:huawei:usg9500_firmware:v500r001c30spc600:*:*:*:*:*:*:*
huaweiusg9500_firmwarev500r001c60spc500cpe:2.3:o:huawei:usg9500_firmware:v500r001c60spc500:*:*:*:*:*:*:*
huaweiusg9500_firmwarev500r005c00spc100cpe:2.3:o:huawei:usg9500_firmware:v500r005c00spc100:*:*:*:*:*:*:*
huaweiusg9500_firmwarev500r005c00spc200cpe:2.3:o:huawei:usg9500_firmware:v500r005c00spc200:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	usg9500_firmware	v500r001c30spc100	cpe:2.3:o:huawei:usg9500_firmware:v500r001c30spc100:::::::*
huawei	usg9500_firmware	v500r001c30spc200	cpe:2.3:o:huawei:usg9500_firmware:v500r001c30spc200:::::::*
huawei	usg9500_firmware	v500r001c30spc600	cpe:2.3:o:huawei:usg9500_firmware:v500r001c30spc600:::::::*
huawei	usg9500_firmware	v500r001c60spc500	cpe:2.3:o:huawei:usg9500_firmware:v500r001c60spc500:::::::*
huawei	usg9500_firmware	v500r005c00spc100	cpe:2.3:o:huawei:usg9500_firmware:v500r005c00spc100:::::::*
huawei	usg9500_firmware	v500r005c00spc200	cpe:2.3:o:huawei:usg9500_firmware:v500r005c00spc200:::::::*

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS

0.002

Percentile

53.8%

JSON

Related for HUAWEI-SA-20200102-01-CREDENTIAL