1006 matches found
Security Advisory - DoS Vulnerability in Huawei Switches
There is a DoS vulnerability caused by memory leak in some of Huawei products as affected products list below. For lacking of adequate input validation，attackers can craft and send a large number of malformed packets to the target device to exhaust the memory of the device and may cause the devic...
Security Advisory - XML Bomb Vulnerability in AnyOffice
AnyOffice Enterprise Mobile Management EMM is a module of the AnyOffice, which provides the mobile terminal management function. The XML Bomb vulnerability in the AnyOffice EMM could allow an authenticated, remote attacker to cause the software to deny services by uploading an XML bomb...
Security Advisory - Reset Password and Information Leak Vulnerabilities in Huawei UMA
The Unified Maintenance Audit UMA system provides a unified portal for O&M operations, controls and records users' O&M operations, and supports auditing by way of command display and video replay. The UMA has two security vulnerabilities. One vulnerability is due to insufficient parameter...
Security Advisory - Uncontrolled Format String Vulnerability on Multiple Products
Several Huawei routers and switches have an uncontrolled format string vulnerability when processing partial commands. An authenticated attacker could exploit this vulnerability to cause a denial of service. Vulnerability ID: HWPSIRT-2016-07011 This vulnerability has been assigned Common...
Security Advisory - Heap Overflow Vulnerability in the HIFI Driver of Huawei Smart Phone
Some Huawei smart phones have a heap overflow security vulnerability in the HIFI driver. An attacker may trick a user into installing a malicious application and use the application to read and modify memory, which can reboot the system or cause permission escalation. Vulnerability ID:...
Security Advisory - Memory Leak Vulnerability in Huawei Products
There is a memory leak vulnerability in huawei products. The software does not sufficiently track and release allocated memory while parse a series of crafted binary messages, which could consume remaining memory. Successful exploit could cause memory exhaust. Vulnerability ID: HWPSIRT-2021-39541...
Security Advisory - Race Condition Vulnerability in Some Huawei Products
There is a race condition vulnerability in some Huawei products. There is a timing window exists in which the database can be operated by another thread that is operating concurrently. Successful exploit may cause the affected device abnormal. Vulnerability ID: HWPSIRT-2020-05257 This vulnerabili...
Security Advisory - Information Leakage Vulnerability in Huawei Products
There is insecure algorithm vulnerability in Huawei products. A module uses less random input in a secure mechanism. Attackers can exploit this vulnerability by brute forcing to obtain sensitive message. This can lead to information leak. Vulnerability ID: HWPSIRT-2020-74955 This vulnerability ha...
Security Advisory - Out-of-Bound Read and Write Vulnerability in Huawei Product
There is an out-of-bound read and write vulnerability in Huawei smartphone. A module dose not verify the input sufficiently. Attackers can exploit this vulnerability by modifying some configuration to cause out-of-bound read and write, causing denial of service. Vulnerability ID: HWPSIRT-2020-051...
Security Advisory - Use After Free Vulnerability in Several Smartphones
There is a use after free vulnerability in several smartphones. There is a condition exists that the system would reference memory after it has been freed, the attacker should trick the user into running a crafted application with high privilege, successful exploit could cause code execution...
Security Advisory - Multiple Vulnerabilities in IPsec IKE of Huawei Firewall Products
There is a Bleichenbacher Oracle vulnerability in the IPSEC IKEv1 implementations of Huawei Firewall products. Remote attackers can decrypt IPSEC tunnel ciphertext data by leveraging a Bleichenbacher RSA padding oracle. Cause a Bleichenbacher oracle attack. Successful exploit this vulnerability c...
Security Advisory - DoS Vulnerability in Some Huawei Products
There is a DoS vulnerability in some Huawei products. Due to insufficient input validation, an attacker could trick a user to execute a malicious application, which could be exploited by attacker to launch DoS attacks. Vulnerability ID: HWPSIRT-2017-05107 This vulnerability has been assigned a...
Security Advisory - Several Vulnerabilities in H323 Protocol of Huawei Products
There are three null pointer dereference vulnerabilities in H323 protocol of Huawei products. An unauthenticated, remote attacker could craft malformed packets and send the packets to the affected products. Due to insufficient validation of packets, which could be exploited to cause process crash...
Security Advisory - Activation Lock Bypass Vulnerability on Smartphones
There is an activation lock bypass vulnerability on Smartphones. The smartphone is supposed to be activated by the former account after reset if find my phone function is on. The software does not have a sufficient protection of activation lock. Successful exploit could allow an attacker to bypas...
Security Advisory - DoS Vulnerability in Some Huawei Products
There is an DoS vulnerability in some Huawei products due to insufficient validation of the parameter when a putty comment key is loaded. An authenticated remote attacker can place a malformed putty key file in system, when a system manager load the key, an infinite loop happens which lead to...
Security Advisory - Information Exposure Vulnerability in Huawei Products
Some Huawei products have an information exposure vulnerability. Encryption keys are stored in the system. The attacker can implement reverse engineering to obtain the encryption keys, causing information exposure. Vulnerability ID: HWPSIRT-2017-07133 This vulnerability has been assigned Common...
Security Advisory - Buffer overflow Vulnerability in Bastet Driver of Huawei Smart Phone
The Bastet driver of some Huawei smart phones has a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege; the APP can send a specific parameter to the driver of the smart phone, causing...
Security Advisory - FRP Bypass Vulnerability in Huawei Honor 5S Smart Phones
Huawei Honor 5S smart phones have a Factory Reset Protection FRP bypass security vulnerability due to the improper design. An attacker can access factory reset page without authorization by only dial with special code. The attacker can exploit this vulnerability to restore the phone to factory...
Security Advisory - Resource Exhaustion Vulnerability in Some Huawei Smartphones
Some Huawei smartphones have a resource exhaustion vulnerability due to configure setting. An attacker tricks a user into installing a malicious application, the application may turn on the device flash-light and rapidly drain the device battery. Vulnerability ID: HWPSIRT-2017-04120 This...
Security Advisory - Privilege Escalation Vulnerability in Push Module of Huawei Smart Phone
There is a privilege escalation vulnerability in Push module of Huawei Smart Phone. An attacker tricks a user to save a rich media into message on the smart phone, which could be exploited to cause the attacker to delete message or fake user to send message. Vulnerability ID: HWPSIRT-2017-05070...
Security Advisory - Buffer Overflow Vulnerability in the Boot Loaders of Huawei Mobile Phones
The boot loaders of some Huawei mobile phones have a buffer overflow vulnerability due to the lack of parameter validation. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause buffer overflow in the...
Security Advisory - XSS Vulnerability in Huawei eSpace IAD
Huawei eSpace Integrated Access Device IAD has a reflected cross-site scripting XSS vulnerability. An attacker could trick a user into clicking a URL containing malicious scripts. Then the user's browser may receive a response from the eSpace IAD and execute the malicious scripts. Successful...
Security Advisory - Multiple Security Vulnerabilities in Driver of Huawei Smart Phones
There are two stack overflow vulnerabilities in video driver. An attacker may trick a user into installing a malicious application and the application can send given parameter to video driver to crash the system or escalate user privilege. Vulnerability ID: HWPSIRT-2016-08056 and HWPSIRT-2016-080...
Security Advisory - Insufficient Input Validation Vulnerability in the FusionInsight
The FusionInsight has an insufficient input validation vulnerability. An attacker may exploit it to gain the root privilege of the Linux system where the software resides and control the operating system cluster. Vulnerability ID: HWPSIRT-2016-06010 This vulnerability has been assigned Common...
Security Advisory - UE Measurement Leak Vulnerability in Huawei P8 Phones
An information leak vulnerability exists in Huawei P8 Phones. Before sending a specific signal to a base station, the P8 Phone does not check its own security status. An attacker uses a fake base station to construct a specific scenario and obtain the specific signal which includes user equipment...
Security Advisory-WPS PIN Offline Brute Force Cracking Vulnerability in Huawei Home Gateway Products
Some Huawei home gateways are affected by the PIN offline brute force cracking vulnerability of the WPS protocol because the random number generator RNG used in the supplier’s solution is not random enough. As a result, brute force cracking the PIN code is easier. After an attacker cracks the PIN...
Security Advisory-DLL Hijacking Vulnerability on Huawei USB Modem products
This security advisory SA describes the impact of DLL-Hijacking vulnerability discovered in website. Vulnerability ID: HWPSIRT-2014-1046 This vulnerability is referenced in this document as follows: Any user in the system can modify the legitimate binary to any kind of malicious executable. If an...
Security Advisory-A Vulnerability on the HWTACACS Authorization Module of the CloudEngine
The HWTACACS modules of some Huawei CloudEngine series switches have vulnerabilities. Attackers can execute the commands that can be used by users with higher-level permissions by bypass the right check of HWTACACS server. HWPSIRT-2013-1256. This Vulnerability has been assigned Common...
Security Advisory - Improper Authentication Vulnerability in Huawei Product
There is an improper authentication vulnerability in Hero-CT060. The vulnerability is due to that when an user wants to do certain operation, the software does not insufficiently validate the user's identity. Successful exploit could allow the attacker to do certain operations which the user are...
Security Advisory - XXE Injection Vulnerability in Huawei Products
There is an XXE injection vulnerability in some Huawei products. A module does not perform the strict operation to the input XML message. Attacker can send specific message to exploit this vulnerability, leading to the module denial of service. Vulnerability ID: HWPSIRT-2020-04355 This...
Security Advisory - Information Disclosure Vulnerability in TE Mobile Software
There is an information disclosure vulnerability in TE Mobile software. Due to the improper storage of some information in certain specific scenario, the attacker can gain information in the victim's device to launch the attack, successful exploit could cause information disclosure. Vulnerability...
Security Advisory - Denial of Service Vulnerability in Some Huawei Products
There is a denial of service vulnerability in some Huawei products. There is no protection against the attack scenario of specific protocol. A remote, unauthorized attacker can construct attack scenarios, which lead to denial of service. Vulnerability ID: HWPSIRT-2020-79490 This vulnerability has...
Security Advisory - Out of Bounds Read Vulnerability in Several Products
There is an out-of-bounds read vulnerability in several products. The software reads data past the end of the intended buffer when parsing certain crafted DHCP messages. Successful exploit could cause certain service abnormal. Vulnerability ID: HWPSIRT-2019-12425 This vulnerability has been...
Security Advisory - Race Condition Vulnerability on Several Smartphones
There is a race condition vulnerability on certain detection module of smartphone. The system does not lock certain function properly, when the function is called by multiple processes could cause out of bound write. An attacker tricks the user into installing a malicious application, successful...
Security Advisory - Sensitive Information Leak Vulnerability in Some Huawei Products
There is a sensitive information leak vulnerability in some Huawei products. An attacker can trick a user to install a malicious application to exploit this vulnerability. Due to insufficient verification of the input, successful exploitation can cause sensitive information leak. Vulnerability ID...
Security Advisory - FRP Bypass Vulnerability on Huawei Smart Phones
There is a FRP bypass vulnerability on Huawei smart phones. During the mobile phone reseting process, an attacker could bypass "Find My Phone" protect after a series of voice and keyboard operations. Successful exploit could allow an attacker to bypass FRP. Vulnerability ID: HWPSIRT-2018-06018 Th...
Security Advisory - Buffer Overflow Vulnerability in Some Huawei Products
There is a buffer overflow vulnerability in the Common Open Policy Service Protocol COPS module of some Huawei products. An unauthenticated, remote attacker has to control the peer device and send specially crafted message to the affected products. Due to insufficient input validation, successful...
Security Advisory - Out-of-Bounds Memory Access Vulnerability in the GPU Driver of Huawei Mobile Phones
There is a out-of-bounds memory access vulnerability in the GPU driver of some Huawei smart phones due to the input parameters validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can call the driver with special parameter and cause...
Security Advisory - Buffer Overflow Vulnerability on Several Products
There is a buffer overflow vulnerability on several products. The software does not sufficiently validate certain field in SCTP messages, a remote unauthenticated attacker could send a crafted SCTP message to the device. Successful exploit could cause system reboot. Vulnerability ID:...
Security Advisory - Two Vulnerabilities in Some Huawei Products
There is a DoS vulnerability in some Huawei products. Due to incorrect malformed message processing logic, an authenticated, remote attacker could send specially crafted message to the target device.Successful exploit of the vulnerability could cause stack overflow and make a service unavailable...
Security Advisory - Integer overflow Vulnerability in Bastet Driver of Huawei Smart Phone
The Bastet driver of some Huawei smart phones has integer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege; the APP can send a specific parameter to the driver of the smart phone, causing arbitra...
Security Advisory - DoS Vulnerability in Wi-Fi Driver of Some Huawei Smart Phones
There is a Denial of Service DoS vulnerability in Wi-Fi driver of some Huawei smart phones. An attacker may trick a user into installing a malicious application and the application can access invalid address of driver to crash the system. Vulnerability ID: HWPSIRT-2017-04153 This vulnerability ha...
Security Advisory - Memory Double Free Vulnerability in Driver of Some Huawei Smart Phones
The soundtrigger driver of some Huawei smart phones has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can start multiple threads and try to free specific memory, which could triggers double free and causes a system crash...
Security Advisory - Brute-force attack of Users' Safe Password in the Files APP in Huawei Mobile Phones
The Files APP in some Huawei mobile phones has a brute-force password cracking vulnerability due to the improper design of the Safe key database. An unauthorized attacker could access sensitive database information and may crack users' Safe passwords, leading to information leak. Vulnerability ID...
Security Advisory - Insufficient Input Validation Vulnerability in Some Huawei Products
Some Huawei products have an insufficient input validation vulnerability. An unauthenticated attacker could send a forged air interface message to an affected product through a rogue base station. Due to insufficient input validation, the attacker could exploit this vulnerability to tamper with a...
Security Advisory - Privilege Elevation Vulnerability Caused by Arbitrary File Upload in Huawei Themes
The Huawei Themes APP in some Huawei products has a privilege elevation vulnerability due to the lack of theme pack check. An attacker could exploit this vulnerability to upload theme packs containing malicious files and trick users into installing the theme packets, resulting in the execution of...
Security Advisory - Memory Leak Vulnerability in Some Huawei Products
Some Huawei products have a memory leak vulnerability. An unauthenticated attacker may send specific Label Distribution Protocol LDP packets to the devices. When the values of some parameters in the packet are abnormal, the LDP processing module does not release the memory to handle the packet,...
Security Advisory - XXE Vulnerability in the E9000
E9000 has an XML External Entity XXE vulnerability when parsing user-supplied XML documents in HMM Hyper Management Module. Attackers could exploit this vulnerability to read arbitrary files and cause a denial of the web service. Vulnerability ID: HWPSIRT-2016-05249 This vulnerability has been...
Security Advisory - Buffer Overflow Vulnerability in Huawei Several Products
There is a vulnerability in several Huawei devices: USG series and NGFW Module. These products have a buffer overflow vulnerability in the Smart DNS function. An attacker may craft a malformed packet with illegitimate parameters, leading to denial of service or the potential execution of arbitrar...
Security Advisory - DoS Vulnerability in FusionCompute
FusionCompute is a cloud OS software for virtualization of hardware resources and central management of virtual, service, and user resources. A DoS vulnerability exists in FusionCompute. An attacker can send abnormal packets as an ordinary user to exhaust system resources and make services...