1009 matches found
Security Advisory - Heap Overflow Vulnerability in the HIFI Driver of Huawei Smart Phone
Some Huawei smart phones have a heap overflow security vulnerability in the HIFI driver. An attacker may trick a user into installing a malicious application and use the application to read and modify memory, which can reboot the system or cause permission escalation. Vulnerability ID:...
Security Advisory - Improper Authentication Vulnerability in Huawei Product
There is an improper authentication vulnerability in Hero-CT060. The vulnerability is due to that when an user wants to do certain operation, the software does not insufficiently validate the user's identity. Successful exploit could allow the attacker to do certain operations which the user are...
Security Advisory - Denial of Service Vulnerability in Huawei Smartphone
There is a denial of service vulnerability in Huawei smartphone. A module does not verify certain parameters sufficiently and it leads to some exceptions. Successful exploit could cause a denial of service condition. Vulnerability ID: HWPSIRT-2020-05281 This vulnerability has been assigned a Comm...
Security Advisory - XXE Injection Vulnerability in Huawei Products
There is an XXE injection vulnerability in some Huawei products. A module does not perform the strict operation to the input XML message. Attacker can send specific message to exploit this vulnerability, leading to the module denial of service. Vulnerability ID: HWPSIRT-2020-04355 This...
Security Advisory - Information Leakage Vulnerability in Huawei Products
There is insecure algorithm vulnerability in Huawei products. A module uses less random input in a secure mechanism. Attackers can exploit this vulnerability by brute forcing to obtain sensitive message. This can lead to information leak. Vulnerability ID: HWPSIRT-2020-74955 This vulnerability ha...
Security Advisory - Out of Bounds Read Vulnerability in Several Products
There is an out-of-bounds read vulnerability in several products. The software reads data past the end of the intended buffer when parsing certain crafted DHCP messages. Successful exploit could cause certain service abnormal. Vulnerability ID: HWPSIRT-2019-12425 This vulnerability has been...
Security Advisory - Race Condition Vulnerability on Several Smartphones
There is a race condition vulnerability on certain detection module of smartphone. The system does not lock certain function properly, when the function is called by multiple processes could cause out of bound write. An attacker tricks the user into installing a malicious application, successful...
Security Advisory - Out-of-Bounds Memory Access Vulnerability in the GPU Driver of Huawei Mobile Phones
There is a out-of-bounds memory access vulnerability in the GPU driver of some Huawei smart phones due to the input parameters validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can call the driver with special parameter and cause...
Security Advisory - Memory Leak Vulnerability in Some Huawei Products
There is a memory leak vulnerability in several Huawei products. The software does not release allocated memory properly when handling XML data. An authenticated, local attacker could upload crafted XML file repeatedly to cause memory leak and service abnormal. Vulnerability ID: HWPSIRT-2017-0803...
Security Advisory - Bypass Vulnerability in the 'Find Phone' Function of Some Huawei Smart Phones
There is an authentication bypass vulnerability in the 'Find Phone' function of some Huawei smart phone. Due to improper authentication realization in the 'Find Phone' function. An attacker may exploit the vulnerability to bypass the 'Find Phone' function in order to use the phone normally...
Security Advisory - Buffer Overflow Vulnerability on Several Products
There is a buffer overflow vulnerability on several products. The software does not sufficiently validate certain field in SCTP messages, a remote unauthenticated attacker could send a crafted SCTP message to the device. Successful exploit could cause system reboot. Vulnerability ID:...
Security Advisory - Use After Free Vulnerability in Madapt Driver of Some Huawei Smart Phones
The Madapt Driver of some Huawei smart phones has a use after free UAF vulnerability. An attacker can trick a user to install a malicious application which has a high privilege to exploit this vulnerability, Successful exploitation may cause arbitrary code execution. Vulnerability ID:...
Security Advisory - Insufficient Input Validation Vulnerability in Bastet of Huawei Smart Phone
The Bastet of some Huawei mobile phones has an insufficient input validation vulnerability due to the lack of parameter validation. An attacker may trick a user into installing a malicious APP. The APP can modify specific parameter to cause system reboot. Vulnerability ID: HWPSIRT-2017-05190 This...
Security Advisory - Insufficient Input Validation Vulnerability in Some Huawei Products
Some Huawei products have an insufficient input validation vulnerability. An unauthenticated attacker could send a forged air interface message to an affected product through a rogue base station. Due to insufficient input validation, the attacker could exploit this vulnerability to tamper with a...
Security Advisory - PXN Defense Mechanism Failure Vulnerability in Huawei Mobile Phones
There is a Privileged Execute-Never PXN defense mechanism failure vulnerability in the drive code of some Huawei mobile phones. An attacker may trick users into installing malicious apps which can disable the PXN defense mechanism by invoking related drive code to crash the system or escalate...
Security Advisory - XML Bomb Vulnerability in AnyOffice
AnyOffice Enterprise Mobile Management EMM is a module of the AnyOffice, which provides the mobile terminal management function. The XML Bomb vulnerability in the AnyOffice EMM could allow an authenticated, remote attacker to cause the software to deny services by uploading an XML bomb...
Security Advisory - Reset Password and Information Leak Vulnerabilities in Huawei UMA
The Unified Maintenance Audit UMA system provides a unified portal for O&M operations, controls and records users' O&M operations, and supports auditing by way of command display and video replay. The UMA has two security vulnerabilities. One vulnerability is due to insufficient parameter...
Security Advisory - DoS Vulnerability in Huawei LogCenter
Huawei LogCenter has a DoS vulnerability. After login to the LogCenter, an attacker can add abnormal device information to the log collection module. The LogCenter system does not verify input device information. As a result, the log collection module denies services. Vulnerability ID:...
Security Advisory - UE Measurement Leak Vulnerability in Huawei P8 Phones
An information leak vulnerability exists in Huawei P8 Phones. Before sending a specific signal to a base station, the P8 Phone does not check its own security status. An attacker uses a fake base station to construct a specific scenario and obtain the specific signal which includes user equipment...
Security Advisory – Authentication Caused Memory Overflow Vulnerability in Some Huawei Switch Products
The user authentication module in some Huawei switch products has the memory overflow vulnerability that can cause device restart when users log in improperly Vulnerability ID: HWPSIRT-2015-02014. This Vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID: CVE-2015-2800...
Security Advisory- SSH Username Information Disclosure Vulnerability in Huawei Campus Switch
Some versions of Huawei Campus switch series products S9300/S9300E/S7700/S9700 /S5700/S6700/S5300/S6300/S2300/S2700/S3300/S3700 are affected by username information disclosure vulnerability. When the maintenance terminal of a Huawei Campus switch uses SSH to log in to a server, attackers can gues...
Security Advisory - Information Leak Vulnerability in Huawei Products
There is an information leak vulnerability in Huawei products. A module does not deal with specific input sufficiently. High privilege attackers can exploit this vulnerability by performing some operations. This can lead to information leak. Vulnerability ID: HWPSIRT-2020-32489 This vulnerability...
Security Advisory - Out-of-Bound Read Vulnerability in Huawei Smartphone
There is an out-of-bound read vulnerability in Huawei smartphone. A module does not verify the some input. Attackers can exploit this vulnerability by sending malicious input through specific app. This could cause out-of-bound, compromising normal service. Vulnerability ID: HWPSIRT-2020-04158 Thi...
Security Advisory - Information Disclosure Vulnerability in TE Mobile Software
There is an information disclosure vulnerability in TE Mobile software. Due to the improper storage of some information in certain specific scenario, the attacker can gain information in the victim's device to launch the attack, successful exploit could cause information disclosure. Vulnerability...
Security Advisory - Logic Error Vulnerability in Several Smartphones
There is a logic error vulnerability in several smartphones. In a special scenario, the system does not properly process. As a result, attackers can perform a series of operations to successfully establish P2P connections that are rejected by the peer end. As a result, the availability of the...
Security Advisory - Stack Overflow Vulnerability in Huawei Smart Phone Product
There is a stack overflow vulnerability in some Huawei smart phone. An attacker can craft specific packet to exploit this vulnerability. Due to insufficient verification, this could be exploited to tamper with the information to affect the availability. Vulnerability ID: HWPSIRT-2019-11030 This...
Security Advisory - Input Validation Vulnerability in Huawei Products
There is an out-of-bound read vulnerability that the IPSec module does not validate a field in a specific message. Attackers can send specific message to cause out-of-bound read, compromising normal service. Vulnerability ID: HWPSIRT-2019-12419 This vulnerability has been assigned a Common...
Security Advisory - Sensitive Information Leak Vulnerability in Some Huawei Products
There is a sensitive information leak vulnerability in some Huawei products. An attacker can trick a user to install a malicious application to exploit this vulnerability. Due to insufficient verification of the input, successful exploitation can cause sensitive information leak. Vulnerability ID...
Security Advisory - FRP Bypass Vulnerability on Huawei Smart Phones
There is a FRP bypass vulnerability on Huawei smart phones. During the mobile phone reseting process, an attacker could bypass "Find My Phone" protect after a series of voice and keyboard operations. Successful exploit could allow an attacker to bypass FRP. Vulnerability ID: HWPSIRT-2018-06018 Th...
Security Advisory - Buffer Overflow Vulnerability in Some Huawei Products
There is a buffer overflow vulnerability in the Common Open Policy Service Protocol COPS module of some Huawei products. An unauthenticated, remote attacker has to control the peer device and send specially crafted message to the affected products. Due to insufficient input validation, successful...
Security Advisory - DoS Vulnerability in Some Huawei Smart Phones
Some Huawei smart phones have a denial of service DoS vulnerability due to the improper processing of malicious parameters. An attacker may trick a target user into installing a malicious APK and launch attacks using a pre-installed app with specific permissions. Successful exploit could allow th...
Security Advisory - Buffer Overflow Vulnerability in Inputhub Driver of Huawei Smart Phone
The inputhub driver of some Huawei mobile phones has a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP and the APP may sends specific data to the inputhub driver to exploit this vulnerablity, successful exploit could...
Security Advisory - Permission Control Vulnerability in Huawei Video Application
There is a permission control vulnerability in Huawei video applications. Due to improper verification of specific infterface, an attacker who is on the same network with the user can obtain some information through a man-in-the-middle attack. Vulnerability ID: HWPSIRT-2018-02026 This vulnerabili...
Security Advisory - Multiple Vulnerabilities in Some Huawei Products
There are two buffer overflow vulnerabilities in some Huawei products. An unauthenticated, remote attacker may send specially crafted SIP packages to the affected products. Due to the insufficient validation of some values for SIP packages, successful exploit may cause services abnormal...
Security Advisory - Insufficient Input Validation Vulnerability in Some Huawei Products
There is an insufficient input validation vulnerability in some Huawei products. An unauthenticated, remote attacker may send crafted IKE V2 messages to the affected products. Due to the insufficient validation of the messages, successful exploit will cause invalid memory access and result in a...
Security Advisory - Multiple Security Vulnerabilities in the IKEv2 Protocol Implementation of Huawei Products
There have multiple vulnerabilities in the IKEv2 protocol on some Huawei products. IKEv2 has an out-of-bounds write vulnerability due to insufficient input validation. An attacker could exploit it to craft special packets to trigger out-of-bounds memory write, which may further lead to system...
Security Advisory - Integer overflow Vulnerability in Bastet Driver of Huawei Smart Phone
The Bastet driver of some Huawei smart phones has integer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege; the APP can send a specific parameter to the driver of the smart phone, causing arbitra...
Security Advisory - FRP Bypass Vulnerability in Huawei Honor 5S Smart Phones
Huawei Honor 5S smart phones have a Factory Reset Protection FRP bypass security vulnerability due to the improper design. An attacker can access factory reset page without authorization by only dial with special code. The attacker can exploit this vulnerability to restore the phone to factory...
Security Advisory - Privilege Escalation Vulnerability in Push Module of Huawei Smart Phone
There is a privilege escalation vulnerability in Push module of Huawei Smart Phone. An attacker tricks a user to save a rich media into message on the smart phone, which could be exploited to cause the attacker to delete message or fake user to send message. Vulnerability ID: HWPSIRT-2017-05070...
Security Advisory - Buffer Overflow Vulnerability in the Boot Loaders of Huawei Mobile Phones
The boot loaders of some Huawei mobile phones have a buffer overflow vulnerability due to the lack of parameter validation. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause buffer overflow in the...
Security Advisory - Privilege Elevation Vulnerability Caused by Arbitrary File Upload in Huawei Themes
The Huawei Themes APP in some Huawei products has a privilege elevation vulnerability due to the lack of theme pack check. An attacker could exploit this vulnerability to upload theme packs containing malicious files and trick users into installing the theme packets, resulting in the execution of...
Security Advisory - Buffer Overflow Vulnerability in Driver of Huawei Smart Phone
The ddrdevfreq driver of some Huawei products has buffer overflow vulnerability due to the lack of a parameters check. An attacker with the root privilege of the Android system can tricks a user into installing a malicious application on the smart phone, and send given parameter to smart phone to...
Security Advisory - DoS Vulnerability in Multiple Huawei Products
There is an denial of service DoS vulnerability in multiple Huawei products. An attacker with specific permission can craft a file containing malicious data and upload it to the device to exhaust memory, causing a DoS condition. Vulnerability ID: HWPSIRT-2016-07088 This vulnerability has been...
Security Advisory - Path Traversal Vulnerability in Multiple Huawei Products
Multiple Huawei products have a path traversal vulnerability. Due to the insufficient path validation, an authenticated attacker may exploit this vulnerability to download some files without authorization, causing information leak. Vulnerability ID: HWPSIRT-2016-07025 This vulnerability has been...
Security Advisory - Cleartext Storage of Crytographic Key Vulnerability in FusionCompute
FusionCompute has a key cleartext storage vulnerability. Successful exploit could allow an attacker to obtain AES keys. Vulnerability ID: HWPSIRT-2016-06076 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID: CVE-2016-6827. Huawei has released software updates to fix...
Security Advisory - Insufficient Input Validation Vulnerability in the FusionInsight
The FusionInsight has an insufficient input validation vulnerability. An attacker may exploit it to gain the root privilege of the Linux system where the software resides and control the operating system cluster. Vulnerability ID: HWPSIRT-2016-06010 This vulnerability has been assigned Common...
Security Advisory - Buffer Overflow Vulnerability in Huawei Several Products
There is a vulnerability in several Huawei devices: USG series and NGFW Module. These products have a buffer overflow vulnerability in the Smart DNS function. An attacker may craft a malformed packet with illegitimate parameters, leading to denial of service or the potential execution of arbitrar...
Security Advisory - Privilege Escalation Vulnerability in Huawei Mate7
Android versions earlier than 5.0 are affected by the vulnerability, which allows an attacker to escalate privilege. Huawei Mate7 is affected by the vulnerability Vulnerability ID: HWPSIRT-2015-01043. This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2014-791...
Security Advisory-WPS PIN Offline Brute Force Cracking Vulnerability in Huawei Home Gateway Products
Some Huawei home gateways are affected by the PIN offline brute force cracking vulnerability of the WPS protocol because the random number generator RNG used in the supplier’s solution is not random enough. As a result, brute force cracking the PIN code is easier. After an attacker cracks the PIN...
Security Advisory - System Command Injection Vulnerability in a Huawei Printer Product
A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution.Vulnerability ID:HWPSIRT-2022-90114 This vulnerability has been assigned a CVEID:CVE-2022-48255...