1030 matches found
Security Advisory - Privilege Escalation Vulnerability in Huawei PCManager Product
There is a privilege escalation vulnerability in Huawei PCManager products. An authenticated, local attacker can perform specific operation to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege. Vulnerability ID: HWPSIRT-2019-10117 This...
Security Advisory - Race Condition Vulnerability on Several Smartphones
There is a race condition vulnerability on certain driver of smartphone. An attacker tricks the user into installing a malicious application, which make multiple processes to operate the same variate at the same time. Successful exploit could cause execution of malicious code. Vulnerability ID:...
Security Advisory - DoS Vulnerability in Some Huawei Smart Phones
Some Huawei smart phones have a denial of service DoS vulnerability due to the improper processing of malicious parameters. An attacker may trick a target user into installing a malicious APK and launch attacks using a pre-installed app with specific permissions. Successful exploit could allow th...
Security Advisory - Information Leak Vulnerability in the NFC Module of Some Huawei Mobile Phones
There is an information leak vulnerability in the Near Field Communication NFC module of some Huawei mobile phones due to insufficient validation on data transfer requests. When an affected mobile phone sends files to an attacker's mobile phone using the NFC function, the attacker can obtain...
Security Advisory - DoS Vulnerability in Some Huawei Switch Products
There is a denial of service DoS vulnerability in Some Huawei switch products. An unauthenticated, remote attacker crafts oversized packets and sends the packets to the affected products. Due to insufficient verification of the packets, successful exploitation may cause the service unavailability...
Security Advisory - Memory Leak Vulnerability in Several Huawei Products
There is a memory leak vulnerability in several Huawei products. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory...
Security Advisory - DoS Vulnerability in Some Huawei Products
Some Huawei products have a DoS vulnerability due to insufficient validation of the Network Quality AnalysisNQA packets. A remote attacker could exploit this vulnerability by sending malformed NQA packets to the target device. Successful exploitation could make the device restart. Vulnerability I...
Security Advisory - Use After Free Vulnerability in Madapt Driver of Some Huawei Smart Phones
The Madapt Driver of some Huawei smart phones has a use after free UAF vulnerability. An attacker can trick a user to install a malicious application which has a high privilege to exploit this vulnerability, Successful exploitation may cause arbitrary code execution. Vulnerability ID:...
Security Advisory - Information Exposure Vulnerability in Huawei Products
Some Huawei products have an information exposure vulnerability. Encryption keys are stored in the system. The attacker can implement reverse engineering to obtain the encryption keys, causing information exposure. Vulnerability ID: HWPSIRT-2017-07133 This vulnerability has been assigned Common...
Security Advisory - FRP Bypass Vulnerability in Huawei Honor 5S Smart Phones
Huawei Honor 5S smart phones have a Factory Reset Protection FRP bypass security vulnerability due to the improper design. An attacker can access factory reset page without authorization by only dial with special code. The attacker can exploit this vulnerability to restore the phone to factory...
Security Advisory - DoS Vulnerability of isub Service in Some Huawei Smartphones
Isub service has a denial of service DoS vulnerability in some Huawei smart phones due to the input parameters validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can send given parameter to specific interface, which make a...
Security Advisory - DoS Vulnerability in Wi-Fi Driver of Some Huawei Smart Phones
There is a Denial of Service DoS vulnerability in Wi-Fi driver of some Huawei smart phones. An attacker may trick a user into installing a malicious application and the application can access invalid address of driver to crash the system. Vulnerability ID: HWPSIRT-2017-04153 This vulnerability ha...
Security Advisory - Input Validation Vulnerability in Touchscreen Driver of Huawei Smart Phones
There is an input validation vulnerability in the touchscreen Driver of some Huawei smart phones. An attacker can tricks a user into installing a malicious application on the smart phone, and send given parameter to smart phone to crash the system. Vulnerability ID: HWPSIRT-2016-12025 This...
Security Advisory - XXE Vulnerability in the E9000
E9000 has an XML External Entity XXE vulnerability when parsing user-supplied XML documents in HMM Hyper Management Module. Attackers could exploit this vulnerability to read arbitrary files and cause a denial of the web service. Vulnerability ID: HWPSIRT-2016-05249 This vulnerability has been...
Security Advisory - IPv6 Neighbor Discovery Crafted Packet Denial of Service Vulnerability
There is a vulnerability in the IP Version 6 IPv6 Neighbor Discovery packet process of multiple products, successful exploit could allow an unauthenticated, remote attacker to cause an affected device to start dropping legitimate IPv6 neighbors as legitimate ND times out, leading to a denial of...
Security Advisory - Brute Force Cracking Vulnerability in Huawei Servers
Huawei server has a brute-force cracking vulnerability due to the lack of authentication protection mechanisms. A remote attacker may obtain user passwords via a brute force attack. Vulnerability ID: HWPSIRT-2016-05247 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE...
Security Advisory - Insufficient Input Validation Vulnerability in the FusionInsight
The FusionInsight has an insufficient input validation vulnerability. An attacker may exploit it to gain the root privilege of the Linux system where the software resides and control the operating system cluster. Vulnerability ID: HWPSIRT-2016-06010 This vulnerability has been assigned Common...
Security Advisory - Buffer Overflow Vulnerability in Huawei Several Products
There is a vulnerability in several Huawei devices: USG series and NGFW Module. These products have a buffer overflow vulnerability in the Smart DNS function. An attacker may craft a malformed packet with illegitimate parameters, leading to denial of service or the potential execution of arbitrar...
Security Advisory - Two DoS Vulnerabilities in the HIFI Driver of Huawei Smart Phone
Some Huawei smart phones have two DoS Denial of Service security vulnerabilities in the HIFI driver. An attacker may trick a user into installing a malicious application and use the application to input null pointer as parameter, which can reboot the system. Vulnerability ID: HWPSIRT-2015-10038 a...
Security Advisory-Two Security Vulnerabilities in the ME906 Wireless Module
ME906 is a mobile Internet access module. The module supports LTE, WCDMA, EVDO, and GSM. The product uses the M.2 interface, supports Windows 7 and Windows 8.1, and is intended for laptop and tablet OEM. This security advisory SA describes the impact of two vulnerabilities. These vulnerabilities...
Security Advisory - IP Option Improper Handling Vulnerability in Multiple Huawei Products
Multiple Huawei Products have an improper IP option handling vulnerability. The IP stack implementation in multiple Huawei products mishandles IP options when a crafted ICMP request message is received, leading to the board reboot Vulnerability ID: HWPSIRT-2015-02003. This Vulnerability has been...
Security Advisory- Local Denial of Service Vulnerability in Huawei Ascend P7
Huawei Ascend P7 Sophia-L09 uses Android 4.4, which is the upgrade version of EMUI 3.0. The phone module crashes when a third-party app sends specific broadcast messages or enables specific UIs. Vulnerability ID: HWPSIRT-2014-1233 This vulnerability has been assigned Common Vulnerabilities and...
Security Advisory-Authority Control Vulnerability in Quidway Switches
Huawei Quidway switches have the authority control vulnerability in access authentication, which may be exploited by attackers to obtain higher access permissions. Vulnerability ID: HWPSIRT-2014-11119 This Vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID: CVE-2015-1460...
Security Advisory - Buffer Overflow Vulnerability in a Huawei Printer Product
A Huawei printer product has a buffer overflow vulnerability. Successful exploitation could lead to device service exceptions. Vulnerability ID:HWPSIRT-2022-17649 This vulnerability has been assigned a CVE ID: CVE-2022-48260...
Security Advisory - Resource Management Errors Vulnerability in Huawei Smartphone Product
There is a resource management errors vulnerability in Huawei smartphone product. Local attackers construct malicious application files, causing system applications to run abnormally. Vulnerability ID: HWPSIRT-2020-06020 This vulnerability has been assigned a Common Vulnerabilities and Exposures...
Security Advisory - Out Of Bound Read Vulnerability in Huawei Smartphone
There is an out of bound read vulnerability in Huawei smartphones. Some functions are lack of verification when they process some messages sent from other module. Attackers can exploit this vulnerability by send malicious message to cause out-of-bound read. This can compromise normal service...
Security Advisory - Code Execution Vulnerability in Fastjson Affect Several Huawei Products
There is a code execution vulnerability in Fastjson affect several Huawei products. Fastjson is an opensource JSON parsing library, successful exploit could allow the attacker bypass the limit of autoType then execute code. Vulnerability ID: HWPSIRT-2020-05962 Huawei has released software updates...
Security Advisory - Missing Initialization of Resource Vulnerability in Some Huawei SmartPhones
Missing Initialization of Resource Vulnerability in Some Huawei Smart Phones. An attacker tricks the user into installing then running a crafted application. Due to improper initialization of specific parameters, successful exploit of this vulnerability may cause device exceptions. Vulnerability...
Security Advisory - Denial of Service Vulnerability in Huawei FusionAccess Product
There is a Denial of Service DoS vulnerability in Huawei FusionAccess Product. Due to insufficient verification on specific input, attackers can exploit this vulnerability by sending constructed messages to the affected device through other device on the same network. Successful exploit could cau...
Security Advisory - Improper Authentication Vulnerability in Huawei Smartphone
There is an improper authentication vulnerability in some Huawei smartphone. Authentication to target component is improper when device performs an operation. Attackers exploit this vulnerability to obtain some information by loading malicious application, leading to information leak. Vulnerabili...
Security Advisory - Double Free Vulnerability on Smartphones
There is a double free vulnerability on certain driver of smartphones. An attacker tricks the user into installing a malicious application, which makes multiple processes to operate the same resource at the same time. Successful exploit could cause a denial of service condition. Vulnerability ID:...
Security Advisory - Information Leakage in Huawei VIP App Web Service
Huawei VIP App is mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20. There is a vulnerability that attackers can conduct bruteforce to the VIP App Web Services to get user information leakage. Vulnerability ID: HWPSIRT-2018-11111 This vulnerability has been assign...
Security Advisory - Information Leak Vulnerability in Some Huawei Smart Phones
Some Huawei smartphones have an information leak vulnerability due to the lack of permission validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can read some hardware serial number, which may cause sensitive information leak...
Security Advisory - FRP Bypass Vulnerability in Some Huawei Smart Phones
There is Factory Reset Protection FRP bypass vulnerability in some Huawei smart phones. An attacker gets some user's smart phone and performs some special operations in the guide function. The attacker may exploit the vulnerability to bypass FRP function and use the phone normally. Vulnerability...
Security Advisory - Authentication Bypass Vulnerability in Some Smart Phones
There is an authentication bypass vulnerability in some Huawei smart phones. An attacker with high privilege obtains the smart phone and bypass the activation function by some specific operations. Vulnerability ID: HWPSIRT-2018-03001 This vulnerability has been assigned a Common Vulnerabilities a...
Security Advisory - Memory Leak Vulnerability in Several Huawei Products
There is a memory leak vulnerability in several Huawei products. The software does not release allocated memory properly when parse XML Schema data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory...
Security Advisory - Sensitive Information Leak Vulnerability in Some Huawei Smart Phones
There is a sensitive information leak vulnerability in the CMA implementation of some Huawei smart phones. An attacker can trick a user to install a malicious application to exploit this vulnerability. Successful exploitation may cause sensitive information leak. Vulnerability ID:...
Security Advisory - DoS Vulnerability in Huawei Firewall Products
There is a DoS vulnerability in some Huawei firewall products. Due to insufficient input validation, a remote attacker who controls the peer device could exploit the vulnerability by sending malformed IKE packets to the target device. Successful exploit of the vulnerability could cause the device...
Security Advisory - Integer Overflow Vulnerability in Some Huawei Products
There is an integer overflow vulnerability in some Huawei products. The attacker sends a response message to the device, which contains an illegal length field, it could produce an integer overflow and restart the modem system. Vulnerability ID: HWPSIRT-2017-06005 This vulnerability has been...
Security Advisory - Use After Free Vulnerability in TEE Module of Some Huawei Smart Phones
The Trusted Execution Environment TEE module driver of some Huawei smart phones has a use after free UAF vulnerability. An attacker tricks a user into installing a malicious application, and the application can start multiple threads and try to create and free specific memory, which could trigger...
Security Advisory - Memory Double Free Vulnerability in Driver of Some Huawei Smart Phones
The soundtrigger driver of some Huawei smart phones has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can start multiple threads and try to free specific memory, which could triggers double free and causes a system crash...
Security Advisory - Plaintext Storage of Users’ Safe Passwords in the Files APP in Huawei Mobile Phones
The Files APP in some Huawei mobile phones has a vulnerability of plaintext storage of users' Safe passwords. An attacker with the root privilege of an Android system could forge the Safe to read users' plaintext Safe passwords, leading to information leak. Vulnerability ID: HWPSIRT-2017-03222 Th...
Security Advisory - Improper Permission Control Vulnerability in Huawei Vmall Alert Service
The AlarmService component in Huawei Vmall has no control over calling permissions, allowing any third party to call. An attacker can construct a malicious application to call it. Consequently, alert music will be played suddenly, compromising user experience. Vulnerability ID: HWPSIRT-2016-11067...
Security Advisory - Phone Activation Bypass Vulnerability in Huawei Smartphones
There is a phone activation bypass vulnerability in Huawei smartphones. Successful exploit could allow an unauthenticated attacker to bypass phone activation to settings page of the phone. Vulnerability ID: HWPSIRT-2016-12004 This vulnerability has been assigned CVE ID: CVE-2017-2705. Huawei has...
Security Advisory - DoS Vulnerability in Multiple Huawei Devices
There is a denial of service DoS vulnerability in multiple Huawei devices. Due to the lack of input validation, a remote attacker may craft a malformed Resource Reservation ProtocolRSVP packet and send it to the device, causing a few buffer overflows and occasional device restart. Vulnerability I...
Security Advisory - Buffer Overflow Vulnerability in Some Videoconference Products
The VP9660, VP9650, and VP9630 are Multipoint Control Units MCUs. As the core devices in videoconferencing systems, they provide endpoint access and conferencing functions. The three devices use the same software, namely, HUAWEI VP9660. The RSE6500 is a multimedia video conferencing server with...
Security Advisory - Input Validation Vulnerability in Multiple Huawei Products
There is an input validation vulnerability in Multiple Huawei products, when the debug switch on the device is enabled, an attacker with network access may exploit this vulnerability by crafting malformed DNS packets and sending them to the target device. As for the lacking of input validation, a...
Security Advisory - DoS Vulnerability in Camera Driver of Huawei Products
Some Huawei products have a DoS vulnerability. An attacker who has the system or camera permission can input invalid parameters into the camera driver program to crash the system. Vulnerability ID: HWPSIRT-2015-09013 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID...
Security Advisory - Out-of-Bounds Write Vulnerability in Some Huawei Products
There is an out-of-bounds write vulnerability in some Huawei products. The code of a module have a bad judgment logic. Attackers can exploit this vulnerability by performing multiple abnormal activities to trigger the bad logic and cause out-of-bounds write. This may compromise the normal service...
Security Advisory - Insufficient Integrity Check Vulnerability in Huawei Product
There is an insufficient integrity vulnerability in Huawei products. A module does not perform sufficient integrity check in a specific scenario. Attackers can exploit the vulnerability by physically install malware. This could compromise normal service of the affected device. Vulnerability ID:...