1006 matches found
Security Advisory - Information Disclosure Vulnerability in the Synaptics Touchscreen Driver
An information disclosure vulnerability in the Synaptics touchscreen driver. An attacker tricks a user into installing a malicious application on the smart phone, and it could enable to access data outside of its permission levels. And cause to the sensitive information leaks. Vulnerability ID:...
Security Advisory - App Lock Bypass Vulnerability in Huawei Mobile Phones
App Lock is a function provided by the Phone Manager app to prevent unauthorized use of apps on mobile phones. Some Huawei mobile phones have an App Lock bypass vulnerability. An attacker could perform specific operations to bypass the App Lock to use apps on a target mobile phone. Vulnerability...
Security Advisory - MITM Vulnerability in Huawei Themes App in Some Mobile Phones
The Themes App in some Huawei mobile phones has a man-in-the-middle MITM vulnerability due to the use of the insecure HTTP protocol for theme download. An attacker may exploit this vulnerability to tamper with downloaded themes. Vulnerability ID: HWPSIRT-2017-06263 This vulnerability has been...
Security Advisory - Privilege Escalation Vulnerability in Some Huawei APKs
Some Huawei APKs have a privilege elevation vulnerability due to improper design. An attacker can trick users into installing a malicious app which can send out HTTP requests and execute JavaScript code in web pages without obtaining the Internet access permission. Successful exploit could lead t...
Security Advisory - Integer Overflow Vulnerability in Some Huawei Products
There is an integer overflow vulnerability in some Huawei products. The attacker sends a response message to the device, which contains an illegal length field, it could produce an integer overflow and restart the modem system. Vulnerability ID: HWPSIRT-2017-06005 This vulnerability has been...
Security Advisory - DoS Vulnerability of isub Service in Some Huawei Smartphones
Isub service has a denial of service DoS vulnerability in some Huawei smart phones due to the input parameters validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can send given parameter to specific interface, which make a...
Security Advisory - Buffer Overflow Vulnerability in Emergdata Driver of Huawei Smart Phones
The emergdata driver of some Huawei smart phones has a buffer overflow vulnerability due to the lack of a parameters check. An attacker with the root privilege of the Android system can tricks a user into installing a malicious application on the smart phone, and send given parameter to smart pho...
Security Advisory - Phone Activation Bypass Vulnerability in Huawei Smartphones
There is a phone activation bypass vulnerability in Huawei smartphones. Successful exploit could allow an unauthenticated attacker to bypass phone activation to settings page of the phone. Vulnerability ID: HWPSIRT-2016-12004 This vulnerability has been assigned CVE ID: CVE-2017-2705. Huawei has...
Security Advisory - Two Vulnerabilities in Huawei WS331a
Huawei WS331a is a Mini Wireless route. There is a Cross-site request forgery CSRF vulnerability in the management interface of WS331a products, an unauthenticated attacker could exploit this vulnerability to perform a CSRF attack. Successful exploit could allow the attacker to submit special...
Security Advisory - Brute Force Cracking Vulnerability in Huawei Servers
Huawei server has a brute-force cracking vulnerability due to the lack of authentication protection mechanisms. A remote attacker may obtain user passwords via a brute force attack. Vulnerability ID: HWPSIRT-2016-05247 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE...
Security Advisory - Several Vulnerabilities in Huawei Honor Routers
Huawei Honor routers do not verify some parameters. As a result, sensitive information may be displayed, causing the leak of sensitive information. Vulnerability ID: HWPSIRT-2016-05053 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID: CVE-2016-5367. Huawei Honor...
Security Advisory - Input Validation Vulnerability in the Video0 Driver of Huawei Smart Phones
There is an input validation vulnerability in Video0 driver of some Huawei smart phones. An attacker may trick a user into installing a malicious application and application can exploit the vulnerability to print stack memory content or crash the system when the application accesses invalid...
Security Advisory - Buffer Overflow Vulnerability in HIFI Driver of Huawei Smart Phone
HIFI driver of some Huawei products have a buffer overflow vulnerability due to the lack of a parameters check. An attacker may trick a user into installing a malicious application, and the application can send given parameter to HIFI driver to crash the system or escalate user privilege...
Security Advisory - DoS Vulnerabilities in JPU Driver of Huawei Products
There are two Denial of Service DoS vulnerabilities in Joint Photographic Experts Group Processing Unit JPU drivers of some Huawei products. An attacker who tricks a user into installing a malicious application which has the system or camera permission may input invalid parameters into the JPU...
Security Advisory - VCM User Horizontal Privilege Escalation Vulnerability
Huawei Video Content Management VCM system does not properly authenticate online users' identities and privileges, which leads to users' horizontal privilege escalation. An attacker may craft malicious messages, send them to the server, and perform illegitimate operations on cases created by othe...
Security Advisory - Information Leak Vulnerability in Huawei DSM Product
There is a information leak vulnerability in DSM Product. The DSM does not clear the clipboard after data in a secure file opened using the DSM is copied and the secure file is closed. Data in the clipboard can be copied in common documents that do not use the DSM, leading to information leaks...
Security Advisory - Input Validation Vulnerability in Huawei VP9660 Products
VP9660 is the multi-point control unit of Huawei Video Conference system. The server of the Huawei VP9660 does not validate the input when using build-in WebServer. In such case, an attacker could log in to the device as an business administrator, graft a message to change the specific informatio...
Security Advisory-Two Security Vulnerabilities in the ME906 Wireless Module
ME906 is a mobile Internet access module. The module supports LTE, WCDMA, EVDO, and GSM. The product uses the M.2 interface, supports Windows 7 and Windows 8.1, and is intended for laptop and tablet OEM. This security advisory SA describes the impact of two vulnerabilities. These vulnerabilities...
Security Advisory-Authority Control Vulnerability in Quidway Switches
Huawei Quidway switches have the authority control vulnerability in access authentication, which may be exploited by attackers to obtain higher access permissions. Vulnerability ID: HWPSIRT-2014-11119 This Vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID: CVE-2015-1460...
Security Advisory-Privilege Escalation Vulnerability in IPMICommand of the HMM Software in a Huawei Server Product
The Hyper Module Management HMM software of some Huawei server products has a security vulnerability. When the operator of the HMM software uses the IPMICommand to perform operations on the iMana software, the operator can modify the user configuration of iMana through privilege escalation...
Security Advisory - Insufficient Integrity Check Vulnerability in Huawei Sound X Product
There is an insufficient integrity check vulnerability in Huawei Sound X Product. The system does not check certain software package's integrity sufficiently. Successful exploit could allow an attacker to load a crafted software package to the device. Vulnerability ID: HWPSIRT-2020-00213 This...
Security Advisory - Resource Management Errors Vulnerability in Huawei Smartphone Product
There is a resource management errors vulnerability in Huawei smartphone product. Local attackers construct malicious application files, causing system applications to run abnormally. Vulnerability ID: HWPSIRT-2020-06020 This vulnerability has been assigned a Common Vulnerabilities and Exposures...
Security Advisory - Integer Overflow Vulnerability in Huawei Smartphone
There is an integer overflow vulnerability in Huawei smartphone. Some functions are lack of verification when they process some messages sent from other module. Attackers can exploit this vulnerability by send malicious message to cause integer overflow. This can compromise normal service...
Security Advisory - Denial of Service Vulnerability in Several Smartphones
There is a denial of service vulnerability in several smartphones. The system does not properly limit the depth of recursion, an attacker should trick the user installing and execute a malicious application. Successful exploit could cause a denial of service condition. Vulnerability ID:...
Security Advisory - Denial of Service Vulnerability in Huawei FusionAccess Product
There is a Denial of Service DoS vulnerability in Huawei FusionAccess Product. Due to insufficient verification on specific input, attackers can exploit this vulnerability by sending constructed messages to the affected device through other device on the same network. Successful exploit could cau...
Security Advisory - Information Leakage Vulnerability on Some Smart Phones
There is an information leakage vulnerability on some Huawei smart phones. An attacker tricks the user into installing a malicious application, which can copy specific files to the sdcard, resulting in information leakage. Vulnerability ID: HWPSIRT-2019-04072 This vulnerability has been assigned ...
Security Advisory - Double Free Vulnerability in Some Huawei Smart Phones
There is a double free vulnerability in some Huawei smart phones. An attacker can trick a user to click a URL to exploit this vulnerability. Successful exploitation may cause the affected phone abnormal. Vulnerability ID: HWPSIRT-2019-04065 This vulnerability has been assigned a Common...
Security Advisory - Plug-in Signature Bypass Vulnerability in Some Huawei Products
There is a plug-in signature bypass vulnerability in some Huawei products due to insufficient plug-in verification. An attacker may tamper with a legitimate plug-in to build a malicious plug-in and trick users into installing it. Successful exploit could allow the attacker to obtain the root...
Security Advisory - Privilege Escalation Vulnerability in Some Huawei Servers
The iBMC Intelligent Baseboard Management Controller of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specially crafted login messages to the affected products. Due to improper authentication design, successful exploit enables low privileged users ...
Security Advisory - DoS Vulnerability in Some Huawei Switch Products
There is a denial of service DoS vulnerability in Some Huawei switch products. An unauthenticated, remote attacker crafts oversized packets and sends the packets to the affected products. Due to insufficient verification of the packets, successful exploitation may cause the service unavailability...
Security Advisory - Improper Resource Management Vulnerability on Huawei Smartphones
There is an improper resource management vulnerability on Huawei smartphones. The software does not properly manage the resource when do device register operation. An attacker tricks the user who has root privilege to install a crafted application, successful exploit could cause certain service...
Security Advisory - Resource Management Errors Vulnerability in Some Huawei Products
The Light Directory Access Protocol LDAP clients of some Huawei products have a resource management errors vulnerability. An unauthenticated, remote attacker may make the LDAP server not respond to the client's request by controlling the LDAP server. Due to improper management of LDAP connection...
Security Advisory - Permission Control Vulnerability in Smart Phones
Some Huawei Smart phones have a permission control vulnerability. Due to improper authorization configuration on specific device information, an attacker with the root privilege can exploit this vulnerability to modify specific device information. Vulnerability ID: HWPSIRT-2017-08157 This...
Security Advisory - Two Buffer overflow Vulnerabilities on Huawei Smart Phone
Some Huawei smart phones have two buffer overflow vulnerabilities due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege; the APP can send a specific parameter to the smart phone, causing the smartphone restart or arbitrary...
Security Advisory - DOS Vulnerability in Bastet Component of Huawei Smart Phone
The Bastet of some Huawei mobile phones has a DOS vulnerability due to the lack of parameter validation. An attacker may trick a user into installing a malicious APP. The APP can modify specific parameter to cause system reboot. Vulnerability ID: HWPSIRT-2017-08155 This vulnerability has been...
Security Advisory - Arbitrary Memory Write Vulnerability in Some Huawei Smart Phones
The boot loaders of some Huawei mobile phones have a arbitrary memory write vulnerability due to the lack of parameter validation. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause arbitrary memory...
Security Advisory - Use After Free Vulnerability in TEE Module of Some Huawei Smart Phones
The Trusted Execution Environment TEE module driver of some Huawei smart phones has a use after free UAF vulnerability. An attacker tricks a user into installing a malicious application, and the application can start multiple threads and try to create and free specific memory, which could trigger...
Security Advisory - Buffer Overflow Vulnerability in Driver of Huawei Smart Phone
The camerafs driver of some Huawei products has buffer overflow vulnerability due to the lack of input validation. An attacker tricks a user into installing a malicious application which has the system privilege of the Android system and sends a specific parameter to the driver of the smart phone...
Security Advisory - DOS Vulnerability in ION Memory Management Module of Huawei Smart Phone
A denial of service DoS vulnerability exists in the ION memory management module of some Huawei mobile phones. An attacker may trick a user into installing a malicious app to send specific parameters to a Huawei mobile phone. Successful exploit could cause the system to restart.Vulnerability ID:...
Security Advisory - Information Leak Vulnerability in Huawei eSpace IAD
Huawei eSpace IAD products have an information leak vulnerability. Some Web pages do not verify the validity of the permission. An attacker can check and download the fault information by access special URL. Vulnerability ID: HWPSIRT-2016-08001 This vulnerability has been assigned a CVE ID:...
Security Advisory - Weak Encryption Algorithm Vulnerability in Huawei Servers
Some Huawei servers have a weak encryption algorithm vulnerability in the iBMC Intelligent Baseboard Management Controller. The software provide an option for users to select SSL encryption algorithms. If an insecure encryption algorithm is selected, an attacker may decrypt encrypted data, causin...
Security Advisory - A Security Vulnerability of Using Insecure Random Numbers to Generate Self-signed Certificates in Huawei Products
Some Huawei products automatically generate self-signed certificates upon the first use. The random numbers used to generate these certificates are not random enough. Different devices' certificates may use the same random number consequently, which contains the risk of an attacker compromising t...
Security Advisory - DoS Vulnerability in the OceanStor 5800
The OceanStor 5800 Storage Systems are mid-range storage products newly developed by Huawei. Huawei Oceanstor 5800 has a DoS vulnerability. An attacker may send massive abnormal HTTP packets to the device. As a result, the HTTP service generates a high CPU usage, and the device denies services...
Security Advisory - SQL Injection Vulnerability in Policy Center Product
Huawei Policy Center dynamically allocates network resources in a unified manner, enabling the network to provide services with more agility. The Policy Center has a SQL injection vulnerability. After logging in to the target device, a remote attacker could exploit this vulnerability by grafting...
Security Advisory - DLL Hijacking Vulnerability on Huawei UTPS
Huawei UTPS software runs on USB modem products to manage data cards. It provides data card setting, dial-up setting, message sending and receiving, and contacts management functions. UTPS contains a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by UTPS...
Security Advisory - Input Check Vulnerability in Huawei Smart Phone
There is a vulnerability in a Huawei smart phone that does not validate input parameter. The attacker tricks the user to install a malicious application to obtain system or camera privilege and then can exploit the vulnerability to make the product system panic. Vulnerability ID: HWPSIRT-2015-110...
Security Advisory - DHCP Snooping Vulnerability in Huawei Multiple Products
Multiple Huawei products have "DHCP Snooping" function. When the "option82 insert" or "option82 rebuild" is enabled on interface, the device is not able to parse some specific DHCP packet correctly, making the device restart. Vulnerability ID：HWPSIRT-2015-08052 This vulnerability has been assigne...
Security Advisory-File Upload Vulnerability on Huawei Honor Cube Wireless Router WS860s
Huawei Honor Cube wireless router WS860s supports the file upload function. It allows users to access its files through the web page. As the device is unable to verify every type of file to be uploaded and does not strictly restrict the file access path through the web page, attackers may upload...
Security Advisory-Memory Overflow Vulnerabilities on Huawei E5332 Webserver
Huawei E5332 wireless router has the following two memory overflow vulnerabilities: Memory overflow occurs when the E5332 Webserver parses a specially crafted HTTP request message, causing the device reboot Vulnerability ID: HWPSIRT-2014-0861. This Vulnerability has been assigned Common...
Security Advisory - Huawei VSM Default User Groups’ Privilege Escalation
VSM Versatile Security Manager is a unified security service management system launched by Huawei for carrier and enterprise customers. VSM contains a vulnerability that default user groups’ privilege could be escalated when one user logs in to the system to modify default user groups’ permission...