1009 matches found
Security Advisory - Two Vulnerabilities in Some Huawei CPE Devices
The outdoor unit of some Customer Premise Equipment CPE has a no authentication vulnerability on a certain port. After accessing the network between the indoor and outdoor units of the CPE, an attacker can deliver commands to the specific port of the outdoor unit and execute them without...
Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones
There is Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker can login the configuration flow by Swype Keyboard and can perform some operations to update the Googl...
Security Advisory - DoS Vulnerability in TLS of Some Huawei Products
There is a input validation vulnerability in some huawei products when handle TLS and DTLS handshake with certificate. Due to the insufficient validation of received PKI certificates, remote attackers could exploit this vulnerability to crash the TLS module. Vulnerability ID: HWPSIRT-2017-03121...
Security Advisory - DoS Vulnerability in Some Huawei Products
There is a DoS Vulnerability in some Huawei products. Due to the lack of adequate input validation, the attacker can send malformed packets to the device, which causes the device memory leaks, leading to DoS attacks. Vulnerability ID: HWPSIRT-2017-02118 This vulnerability has been assigned a Comm...
Security Advisory - Memory Leak Vulnerability in Some Huawei Products
Some Huawei products have a memory leak vulnerability. An unauthenticated attacker may send specific Label Distribution Protocol LDP packets to the devices. When the values of some parameters in the packet are abnormal, the LDP processing module does not release the memory to handle the packet,...
Security Advisory - Multiple Security Vulnerabilities in Huawei Smart Phone Products
The TrustZone driver of some Huawei smart phone products has an input validation vulnerability. An attacker may trick the target user into installing a malicious APP which could exploit this vulnerability to pass specific parameters to the TrustZone driver. Successful exploit could cause the syst...
Security Advisory - Input Validation Vulnerability in Wi-Fi Driver of Huawei Smart Phones
There is an input validation vulnerability in the Wi-Fi Driver of some Huawei smart phones. An attacker may trick a user into installing a malicious application, and the application can exploit this vulnerability to gain privileges for certain system calls. Vulnerability ID: HWPSIRT-2016-11026 Th...
Security Advisory - Two Information Leak Vulnerabilities in ION Memory Management Module of Huawei Smart Phone
Two information leak vulnerabilities exist in the ION memory management module of some Huawei mobile phones due to the lack of initialization during memory allocation. Vulnerability ID: HWPSIRT-2016-09032 and HWPSIRT-2016-09033 These two vulnerabilities have been assigned CVE ID: CVE-2016-8757 an...
Security Advisory - Hardcoded SSH Key Vulnerability in Some Huawei Storage Products
Some Huawei storage products have a hardcoded SSH key vulnerability. Different nodes of the devices use SSH to encrypt communication data and authenticate each other based on public and private keys. Since the SSH public and private keys are hardcoded, an attacker may obtain the keys and log in t...
Security Advisory - Buffer Overflow Vulnerability in Huawei USG Products
The Authentication, Authorization and Accounting AAA module in the USG products has a buffer overflow vulnerability. A remote attacker can send crafted Enterprise Application Platform EAP packets to the USG products through a Remote Authentication Dial In User Service RADIUS server which has...
Security Advisory- Risk of Password Being Cracked Due to DES Encryption Algorithm
In multiple Huawei products, DES encryption algorithm is used for password and the encryption is not strong enough so it may be cracked HWNSIRT-2012-0820. This Vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID: CVE-2012-4960. Temporary fix for this vulnerability is...
Security Advisory - System Command Injection Vulnerability in a Huawei Printer Product
A Huawei printer has a system command injection vulnerability. Successful exploitation could allow attackers to gain higher privileges. Vulnerability ID:HWPSIRT-2022-87340 This vulnerability has been assigned a CVE ID: CVE-2022-48259...
Security Advisory - The input verification vulnerability of a Huawei Device product is involved.
A Huawei device has an input verification vulnerability. Successful exploitation of this vulnerability may lead to DoS attacks. Vulnerability ID: HWPSIRT-2022-49379 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2022-37395. For products that have released...
Security Advisory - Input Verification Vulnerability Involving Huawei Printer Products
Huawei printers have an input verification vulnerability. Successful exploitation of this vulnerability may cause device service exceptions. Vulnerability ID: HWPSIRT-2022-80078 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2022-34159. For products that...
Security Advisory - CSV Injection Vulnerability in Some Huawei Products
There is a CSV injection vulnerability in some Huawei Products. An attacker with high privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files ...
Security Advisory - Use-after-free Vulnerability in Huawei Products
There is a use-after-free UAF vulnerability in Huawei products. An attacker may craft specific packets to exploit this vulnerability. Successful exploitation may cause the service abnormal. Vulnerability ID: HWPSIRT-2020-67955 This vulnerability has been assigned a Common Vulnerabilities and...
Security Advisory - Logic Vulnerability in Huawei Gauss100 Product
There is a logic vulnerability in Huawei Gauss100 OLTP Product. An attacker with certain permissions could perform specific SQL statement to exploit this vulnerability. Due to insufficient security design, successful exploit can cause service abnormal. Vulnerability ID: HWPSIRT-2020-94600 This...
Security Advisory - Privilege Escalation Vulnerability in FusionCompute Product
There is a privilege escalation vulnerability in FusionCompute product. Due to improper privilege management, an attacker with common privilege may access some specific files and get the administrator privilege in the affected products. Successful exploit will cause privilege escalation...
Security Advisory - Improper Interface Design Vulnerability in Huawei Product
There is an improper interface design vulnerability in Huawei product. A module interface of the impated product does not deal with some operations properly. Attackers can exploit this vulnerability to perform malicious operatation to compromise module service. Vulnerability ID: HWPSIRT-2020-0501...
Security Advisory - Command Injection Vulnerability in FusionCompute
There is a command injection vulnerability in FusionCompute. The software does not sufficiently validate certain parameters post from user, successful exploit could allow an authenticated attacker to launch a command injection attack. Vulnerability ID: HWPSIRT-2020-05015 This vulnerability has be...
Security Advisory - Protection Mechanism Failure Vulnerability in Some Huawei Products
There is a protection mechanism failure vulnerability in some Huawei products. The product incorrectly uses a protection mechanism. An attacker has to find a way to exploit the vulnerability to conduct directed attacks against the affected product. Vulnerability ID: HWPSIRT-2020-05077 This...
Security Advisory - Use After Free Vulnerability in Several Smartphones
There is a use after free vulnerability in several smartphones. There is a condition exists that the system would reference memory after it has been freed, the attacker should trick the user into running a crafted application with common privilege, successful exploit could cause code execution...
Security Advisory - Insufficient Integrity Check Vulnerability in Several Smartphones
There is an insufficient integrity check vulnerability in several smartphones. The system does not check certain software package's integrity sufficiently, successful exploit could allow an attacker to load a crafted software package to the device. Vulnerability ID: HWPSIRT-2019-11020 This...
Security Advisory - Authentication Bypass Vulnerability in Some Huawei Smart Phones
Some Huawei smartphones have an authentication bypass vulnerability. When the attacker obtains the user's smartphone, the vulnerability can be used to replace the start-up program so that the attacker can obtain the information in the smartphone and achieve the purpose of controlling the...
Security Advisory - Authentication Bypass Vulnerability in Some Huawei Mobile Phones
There is an authentication bypass vulnerability in some Huawei mobile phones. An attacker could trick the user to connect to a malicious device. In the debug mode, the malicious software in the device may exploit the vulnerability to bypass some specific function. Successful exploit may cause som...
Security Advisory - Remote Code Execution Vulnerability in Microsoft Windows Print Spooler Service
Microsoft released a security bulletin MS10-061 to publicly disclose a remote code execution vulnerability in the Print Spooler service. The vulnerability could allow remote code execution if an attacker sends a specially crafted print request to a vulnerable system. Vulnerability ID:...
Security Advisory - Two Remote Code Execution Vulnerabilities in Microsoft Windows
Microsoft released a security advisory to disclose a remote code execution vulnerability in Microsoft Server Message Block 1.0 SMBv1. A remote attacker could send a specially crafted packet to a targeted SMBv1 server. The attacker could exploit the vulnerability to gain the ability to execute cod...
Security Advisory - Information Leak Vulnerability in Some Huawei Smart Phones
There is a information leak vulnerability in the date service proxy implementation of some Huawei smart phones. An attacker may trick a user into installing a malicious application and application can exploit the vulnerability to get kernel date, which may cause sensitive information leak...
Security Advisory - DoS Vulnerability in XML Parser of Some Huawei Products
XML parser has a DoS vulnerability in some Huawei products. Due to not check the specially XML file enough, an authenticated local attacker may craft specific XML files to the affected products and parse this file, which cause to null pointer accessing and result in DoS attacks. Vulnerability ID:...
Security Advisory - Multiple Vulnerabilities in FusionSphere OpenStack
There is a privilege escalation vulnerability in Huawei FusionSphere OpenStack. Due to improper privilege restrictions, an attacker with high privilege may obtain the other users' certificates. Successful exploit may cause privilege escalation. Vulnerability ID: HWPSIRT-2017-07053 This...
Security Advisory - Three Vulnerabilities in Huawei FusionSphere
There is an incorrect authorization vulnerability in Huawei FusionSphere. An authenticated attacker could execute commands that he/she should have had no permission to perform, thereby querying, modifying, and deleting certain service data and making the service unavailable. Vulnerability ID:...
Security Advisory - Authentication Bypass Vulnerability in the 'Find Phone' Function of some Huawei Smart Phones
The 'Find Phone' function of some Huawei smart phones has an authentication bypass vulnerability. An unauthenticated attacker may wipe and factory reset the phone by special steps. Due to missing authentication of the 'Find Phone' function, an attacker may exploit the vulnerability to bypass the...
Security Advisory - Input Validation Vulnerabilities in Camera Driver of Huawei Smart Phones
There are five input validation vulnerabilities in the Camera driver of some Huawei smart phones. An attacker may trick a user into installing a malicious application, and the application can send given parameter to Camera driver to crash the system or escalate user privilege. Vulnerability ID:...
Security Advisory - Bar Mitzvah Attack Vulnerability in Huawei Products
A security vulnerability exists in Rivest Cipher 4 RC4 used by TLS and SSL protocols. RC4 cannot provide sufficient data protection. After listening to an SSL or TLS connection, an attacker can obtain plaintext data by brute force cracking. This vulnerability is also called Bar Mitzvah...
Security Advisory - Path Traversal Vulnerability in Huawei Home Music System
Huawei Home Music System has a path traversal vulnerability. Successful exploitation of this vulnerability may cause the music host file to be deleted or the file permission to be changed.Vulnerability ID:HWPSIRT-2023-60613 This vulnerability has been assigned a CVEID:CVE-2023-7300...
Security Advisory - Identity Authentication Bypass Vulnerability in Huawei HiLink AI Life Product
Huawei HiLink AI Life product has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may allow attackers to access restricted functions.Vulnerability ID:HWPSIRT-2022-42291 This vulnerability has been assigned a CVEID:CVE-2022-48470...
Security Advisory - Data Processing Error Vulnerability in a Huawei Band
A Huawei band has a data processing error vulnerability. Successful exploitation could bypass lock screen authentication.Vulnerability ID:HWPSIRT-2022-11965 This vulnerability has been assigned a CVEID:CVE-2022-48254...
Security Advisory - Path Traversal Vulnerability in Huawei FusionCube Product
There is a path traversal vulnerability in Huawei FusionCube product. The vulnerability is due to that the software uses external input to construct a pathname that is intended to identify a directory that is located underneath a restricted parent directory, but the software does not properly...
Security Advisory - Resource Management Error Vulnerability in Some Huawei Products
There is a resource management error vulnerability in some Huawei Products. An authentication attacker needs to perform specific operations to exploit the vulnerability on the affected device. Due to improper resource management of the function, the vulnerability can be exploited to cause service...
Security Advisory - Insufficient Input Validation Vulnerability in FusionCompute Product
There is an insufficient input validation vulnerability in FusionCompute product. Due to the input validation is insufficient, an attacker can exploit this vulnerability to upload any files to the device. Successful exploit may cause the service abnormal. Vulnerability ID: HWPSIRT-2020-05085 This...
Security Advisory - Use-after-free Vulnerability in Some Huawei Smart Phone
There is a use-after-free UAF vulnerability in some Huawei smart phone. An authenticated, local attacker may perform specific operations to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege and make information leak. Vulnerability ID:...
Security Advisory - Denial of Service Vulnerability in SmartPhone Product
There is a denial of service vulnerability in several smartphones. In specific scenario, due to the improper resource management and memory leak of some feature, the attacker could exploit this vulnerability to cause the device reset. Vulnerability ID: HWPSIRT-2020-04032 This vulnerability has be...
Security Advisory - Buffer Overflow Vulnerability in Several Smartphones
There is a buffer overflow vulnerability in several smartphones. The software access data past the end, or before the beginning, of the intended buffer when handling certain operations of certificate, the attacker should trick the user into installing a malicious application, successful exploit m...
Security Advisory - Logic Check Error Vulnerability in Several Smartphones
There is a logic check error vulnerability in several smartphones. A logic error occurs when the software checking the size of certain parameter, the attacker should trick the user into installing a malicious application, successful exploit may cause code execution. Vulnerability ID:...
Security Advisory - Information Disclosure Vulnerability in Several Smartphones
There is an information disclosure vulnerability in several smartphones. Certain WI-FI function's default configuration in the system seems insecure, an attacker should craft a WI-FI hotspot to launch the attack. Successful exploit could cause information disclosure. Vulnerability ID:...
Security Advisory - Out of Bounds Read Vulnerability in Some Huawei Products
There is an out-of-bounds read vulnerability in some Huawei products. Due to a logical flaw in a JSON parsing routine, a remote, unauthenticated attacker could exploit this vulnerability to disrupt service in the affected products. Vulnerability ID: HWPSIRT-2018-12378 This vulnerability has been...
Security Advisory - Information Leak Vulnerability in Some Huawei Smartphones
There is an information leak vulnerability in some Huawei smartphones. An attacker may do some specific configuration in the smartphone and trick a user into inputting some sensitive information. Due to improper design, successful exploit may cause some information leak. Vulnerability ID:...
Security Advisory - Two JSON Injection Vulnerabilities in Some Huawei Servers
The iBMC Intelligent Baseboard Management Controller of some Huawei servers have two JSON injection vulnerabilities due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers t...
Security Advisory - Two Out-of-Bounds Read Vulnerabilities in Some Huawei Products
Some Huawei products have two out-of-bounds read vulnerabilities due to the improper processing of malformed H323 messages. A remote attacker that controls a server could exploit this vulnerability by sending malformed H323 reply messages to a target device. Successful exploit could make the devi...
Security Advisory - Three Out-of-bounds Read Vulnerabilities in Some Huawei Products
There are three out-of-bounds read vulnerabilities in some Huawei products. Due to insufficient input validation, a remote attacker could exploit these vulnerabilities by sending specially crafted SS7 related packets to the target devices. Successful exploit will cause out-of-bounds read and...