1030 matches found
Security Advisory - Path Traversal Vulnerability in Multiple Huawei Products
Multiple Huawei products have a path traversal vulnerability. Due to the insufficient path validation, an authenticated attacker may exploit this vulnerability to download some files without authorization, causing information leak. Vulnerability ID: HWPSIRT-2016-07025 This vulnerability has been...
Security Advisory - Reset Password and Information Leak Vulnerabilities in Huawei UMA
The Unified Maintenance Audit UMA system provides a unified portal for O&M operations, controls and records users' O&M operations, and supports auditing by way of command display and video replay. The UMA has two security vulnerabilities. One vulnerability is due to insufficient parameter...
Security Advisory - DLL Hijacking Vulnerability on Huawei HiSuite
The HiSuite is mobile assistant software on PCs. This software contains a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by HiSuite improperly. And it allows an attacker to load this DLL file of the attacker's choosing that could execute arbitrary code...
Security Advisory - Input Validation Vulnerability in Huawei AR3200
There is an input validation vulnerability in Huawei AR3200, which allows an attacker who logs into the device to send malformed packets, causing the AR3200 occasionally restart and a Denial of Service. Vulnerability ID: HWPSIRT-2015-10047 This vulnerability has been assigned Common Vulnerabiliti...
Security Advisory -Input Verification Vulnerabilities Involved in Huawei Printer Product
There is an improper input verification vulnerability in Huawei printer product. Successful exploitation of this vulnerability may cause service abnormal. Vulnerability ID: HWPSIRT-2022-87185 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2022-32204. For...
Security Advisory - Improper Authentication Vulnerability in Huawei Product
There is an improper authentication vulnerability in Hero-CT060. The vulnerability is due to that when an user wants to do certain operation, the software does not insufficiently validate the user's identity. Successful exploit could allow the attacker to do certain operations which the user are...
Security Advisory - Logic Vulnerability in Huawei WATCH Kid Product
There is a logic vulnerability in Huawei WATCH Kid product. An unauthenticated attacker could perform specific operations to exploit this vulnerability. Due to insufficient security design, successful exploit could allow an attacker to add users to be friends without prompting in the target devic...
Security Advisory - Race Condition Vulnerability in Some Huawei Products
There is a race condition vulnerability in some Huawei products. There is a timing window exists in which the database can be operated by another thread that is operating concurrently. Successful exploit may cause the affected device abnormal. Vulnerability ID: HWPSIRT-2020-05257 This vulnerabili...
Security Advisory - Information Leakage Vulnerability in Huawei Products
There is insecure algorithm vulnerability in Huawei products. A module uses less random input in a secure mechanism. Attackers can exploit this vulnerability by brute forcing to obtain sensitive message. This can lead to information leak. Vulnerability ID: HWPSIRT-2020-74955 This vulnerability ha...
Security Advisory - Information Disclosure Vulnerability in TE Mobile Software
There is an information disclosure vulnerability in TE Mobile software. Due to the improper storage of some information in certain specific scenario, the attacker can gain information in the victim's device to launch the attack, successful exploit could cause information disclosure. Vulnerability...
Security Advisory - Privilege Escalation Vulnerability in Huawei Smartphone
There is a privilege escalation vulnerability on Huawei smart phones due to design defects. The attacker needs to physically contact the mobile phone and obtain higher privileges, and execute relevant commands, resulting in the user's privilege promotion. Vulnerability ID: HWPSIRT-2020-00070 This...
Security Advisory - Information Leakage Vulnerability on Several Huawei Products
There is an information leakage vulnerability on several Huawei products. Due to insufficient communication protection for specific services, a remote, unauthorized attacker can exploit this vulnerability to connect to specific services to obtain additional information. Successful exploitation of...
Security Advisory - Out-of-bounds Read Vulnerability in Some Huawei Products
There is an out-of-bounds read vulnerability in some Huawei products. An unauthenticated, remote attacker has to control the peer device and craft the Signalling Connection Control Part SCCP messages to the target devices. Due to insufficient input validation of some values in the messages,...
Security Advisory - DoS Vulnerability in Some Huawei MBB Products
Some Huawei MBB Mobile Broadband products have a Denial of Service DoS vulnerability. When an attacker accessing device sends special http request to device, the webserver process will try to apply too much memory which can cause the device to become unable to respond. An attacker can launch a Do...
Security Advisory - Activation Lock Bypass Vulnerability on Smartphones
There is an activation lock bypass vulnerability on Smartphones. The smartphone is supposed to be activated by the former account after reset if find my phone function is on. The software does not have a sufficient protection of activation lock. Successful exploit could allow an attacker to bypas...
Security Advisory - Multiple Security Vulnerabilities in the IKEv2 Protocol Implementation of Huawei Products
There have multiple vulnerabilities in the IKEv2 protocol on some Huawei products. IKEv2 has an out-of-bounds write vulnerability due to insufficient input validation. An attacker could exploit it to craft special packets to trigger out-of-bounds memory write, which may further lead to system...
Security Advisory - DoS Vulnerability in Some Huawei Products
There is an DoS vulnerability in some Huawei products due to insufficient validation of the parameter when a putty comment key is loaded. An authenticated remote attacker can place a malformed putty key file in system, when a system manager load the key, an infinite loop happens which lead to...
Security Advisory - Out-of-bounds Read Vulnerability in Some Huawei Products
There is an out-of-bounds read vulnerability in some Huawei products. An attacker has to control the peer device and send specially crafted messages to the affected products. Due to insufficient input validation, successful exploit may cause some service abnormal. Vulnerability ID:...
Security Advisory - Improper Authorization Vulnerability in Some Huawei Products
Some Huawei products have an improper authorization vulnerability due to improper permission settings for a certain file on the host machine. An authenticated attacker could create a large number of virtual machine VM processes to exhaust system resources. Successful exploit could make new VMs...
Security Advisory - Privilege Escalation Vulnerability in Push Module of Huawei Smart Phone
There is a privilege escalation vulnerability in Push module of Huawei Smart Phone. An attacker tricks a user to save a rich media into message on the smart phone, which could be exploited to cause the attacker to delete message or fake user to send message. Vulnerability ID: HWPSIRT-2017-05070...
Security Advisory - Brute-force attack of Users' Safe Password in the Files APP in Huawei Mobile Phones
The Files APP in some Huawei mobile phones has a brute-force password cracking vulnerability due to the improper design of the Safe key database. An unauthorized attacker could access sensitive database information and may crack users' Safe passwords, leading to information leak. Vulnerability ID...
Security Advisory - Buffer Overflow Vulnerability in the Boot Loaders of Huawei Mobile Phones
The boot loaders of some Huawei mobile phones have a buffer overflow vulnerability due to the lack of parameter validation. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause buffer overflow in the...
Security Advisory - Privilege Escalation Vulnerability in the FusionStorage
FusionStorage is a piece of distributed block storage software specifically designed for the storage infrastructure of cloud computing data centers. The maintenance module of Huawei FusionStorage has a privilege escalation vulnerability. After logging in to the FusionStorage successfully as a...
Security Advisory - PXN Defense Mechanism Failure Vulnerability in Huawei Mobile Phones
There is a Privileged Execute-Never PXN defense mechanism failure vulnerability in the drive code of some Huawei mobile phones. An attacker may trick users into installing malicious apps which can disable the PXN defense mechanism by invoking related drive code to crash the system or escalate...
Security Advisory - Information Leak Vulnerability in Huawei Smart Phones
Some Huawei smartphones have an information leak vulnerability due to improper security status verification. An attacker may use a rogue base station to obtain information about subscribers' signal strengths. Vulnerability ID: HWPSIRT-2015-12007 This vulnerability has been assigned Common...
Security Advisory - Heap Overflow Vulnerability in the HIFI Driver of Huawei Smart Phone
Some Huawei smart phones have a heap overflow security vulnerability in the HIFI driver. An attacker may trick a user into installing a malicious application and use the application to read and modify memory, which can reboot the system or cause permission escalation. Vulnerability ID:...
Security Advisory - Denial of Service Vulnerability in Huawei Smartphone
There is a denial of service vulnerability in Huawei smartphone. A module does not verify certain parameters sufficiently and it leads to some exceptions. Successful exploit could cause a denial of service condition. Vulnerability ID: HWPSIRT-2020-05281 This vulnerability has been assigned a Comm...
Security Advisory - XXE Injection Vulnerability in Huawei Products
There is an XXE injection vulnerability in some Huawei products. A module does not perform the strict operation to the input XML message. Attacker can send specific message to exploit this vulnerability, leading to the module denial of service. Vulnerability ID: HWPSIRT-2020-04355 This...
Security Advisory - Weak Algorithms Vulnerability in Huawei Smartphone
There is a weak algorithm vulnerability in Huawei smartphone. The protection is insufficient for the modules that should be protected. Local attackers can exploit this vulnerability to affect the integrity of certain module. Vulnerability ID: HWPSIRT-2020-37421 This vulnerability has been assigne...
Security Advisory - Out-of-Bound Read Vulnerability in Huawei Smartphone
There is an out-of-bound read vulnerability in Huawei smartphone. A module does not verify the some input. Attackers can exploit this vulnerability by sending malicious input through specific app. This could cause out-of-bound, compromising normal service. Vulnerability ID: HWPSIRT-2020-04158 Thi...
Security Advisory - Stack Overflow Vulnerability in Huawei Smart Phone Product
There is a stack overflow vulnerability in some Huawei smart phone. An attacker can craft specific packet to exploit this vulnerability. Due to insufficient verification, this could be exploited to tamper with the information to affect the availability. Vulnerability ID: HWPSIRT-2019-11030 This...
Security Advisory - Race Condition Vulnerability on Several Smartphones
There is a race condition vulnerability on certain detection module of smartphone. The system does not lock certain function properly, when the function is called by multiple processes could cause out of bound write. An attacker tricks the user into installing a malicious application, successful...
Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones
There is Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker can login the Talkback mode and can perform some operations to access the setting page. As a result, t...
Security Advisory - FRP Bypass Vulnerability on Several Smartphones
There is a Factory Reset Protection FRP bypass vulnerability on several smartphones. The system does not sufficiently verify the permission, an attacker uses a data cable to connect the smartphone to another smartphone and then perform a series of specific operations. Successful exploit could all...
Security Advisory - Buffer Overflow Vulnerability in Some Huawei Products
There is a buffer overflow vulnerability in the Common Open Policy Service Protocol COPS module of some Huawei products. An unauthenticated, remote attacker has to control the peer device and send specially crafted message to the affected products. Due to insufficient input validation, successful...
Security Advisory - Arbitrary Memory Free Vulnerability in GPU Driver of Some Huawei Smart Phones
There is an arbitrary memory free vulnerability in GPU driver of some Huawei smart phones due to insufficient parameters verification. An attacker can tricks a user into installing a malicious application on the smart phone, and send given parameter to driver to release special kernel memory...
Security Advisory - DoS Vulnerability in Some Huawei Products
There is a DoS vulnerability in some Huawei products. Due to insufficient input validation, an attacker could trick a user to execute a malicious application, which could be exploited by attacker to launch DoS attacks. Vulnerability ID: HWPSIRT-2017-05107 This vulnerability has been assigned a...
Security Advisory - Information Disclosure Vulnerability in CIDAM Protocol on Huawei Products
Part of Huawei Products use the CIDAM protocol, which contains sensitive information in the message when it is implemented. So these products has an information disclosure vulnerability. An authenticated remote attacker could track and get the message of a target system. Successful exploit could...
Security Advisory - Multiple Vulnerabilities in Some Huawei Products
There are two buffer overflow vulnerabilities in some Huawei products. An unauthenticated, remote attacker may send specially crafted SIP packages to the affected products. Due to the insufficient validation of some values for SIP packages, successful exploit may cause services abnormal...
Security Advisory - Multiple Security Vulnerabilities in Huawei iReader
Huawei iReader app has three security vulnerabilities. The app has an input validation vulnerability due to insufficient validation on the URL used for loading network data. An attacker can control app access and load malicious websites created by the attacker, and the code in webpages would be...
Security Advisory - Use After Free Vulnerability in Madapt Driver of Some Huawei Smart Phones
The Madapt Driver of some Huawei smart phones has a use after free UAF vulnerability. An attacker can trick a user to install a malicious application which has a high privilege to exploit this vulnerability, Successful exploitation may cause arbitrary code execution. Vulnerability ID:...
Security Advisory - Information Exposure Vulnerability in Huawei Products
Some Huawei products have an information exposure vulnerability. Encryption keys are stored in the system. The attacker can implement reverse engineering to obtain the encryption keys, causing information exposure. Vulnerability ID: HWPSIRT-2017-07133 This vulnerability has been assigned Common...
Security Advisory - Insufficient Input Validation Vulnerability in Bastet of Huawei Smart Phone
The Bastet of some Huawei mobile phones has an insufficient input validation vulnerability due to the lack of parameter validation. An attacker may trick a user into installing a malicious APP. The APP can modify specific parameter to cause system reboot. Vulnerability ID: HWPSIRT-2017-05190 This...
Security Advisory - Two DoS Vulnerabilities in Call Module of Some Huawei Smart Phones
There are two DoS vulnerabilities in the call module of some Huawei smart phones due to the lack of a parameters check. An attacker may trick a user into installing a malicious application, and the application can send given parameter to call module to crash the call and data communication proces...
Security Advisory - DoS Vulnerability in Wi-Fi Driver of Some Huawei Smart Phones
There is a Denial of Service DoS vulnerability in Wi-Fi driver of some Huawei smart phones. An attacker may trick a user into installing a malicious application and the application can access invalid address of driver to crash the system. Vulnerability ID: HWPSIRT-2017-04153 This vulnerability ha...
Security Advisory - DoS Vulnerability in Multiple Huawei Products
There is an denial of service DoS vulnerability in multiple Huawei products. An attacker with specific permission can craft a file containing malicious data and upload it to the device to exhaust memory, causing a DoS condition. Vulnerability ID: HWPSIRT-2016-07088 This vulnerability has been...
Security Advisory - Buffer Overflow Vulnerability in Huawei Firewall Products
The security policy processing module of some Huawei firewall products have a buffer overflow vulnerability. An authenticated attacker may setup a specific security policy into the devices, causing buffer overflow and crash the system. Vulnerability ID: HWPSIRT-2016-06074 This vulnerability has...
Security Advisory - DoS Vulnerability in Huawei Switches
There is a DoS vulnerability caused by memory leak in some of Huawei products as affected products list below. For lacking of adequate input validation，attackers can craft and send a large number of malformed packets to the target device to exhaust the memory of the device and may cause the devic...
Security Advisory - XXE Vulnerability in the E9000
E9000 has an XML External Entity XXE vulnerability when parsing user-supplied XML documents in HMM Hyper Management Module. Attackers could exploit this vulnerability to read arbitrary files and cause a denial of the web service. Vulnerability ID: HWPSIRT-2016-05249 This vulnerability has been...
Security Advisory - Brute Force Cracking Vulnerability in Huawei Servers
Huawei server has a brute-force cracking vulnerability due to the lack of authentication protection mechanisms. A remote attacker may obtain user passwords via a brute force attack. Vulnerability ID: HWPSIRT-2016-05247 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE...