1030 matches found
Security Advisory - Memory Leak Vulnerability in Several Huawei Products
There is a memory leak vulnerability in several Huawei products. The software does not release allocated memory properly when parse XML Schema data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory...
Security Advisory - DoS Vulnerability in Some Huawei Products
There is a DoS vulnerability caused by memory exhaustion in some Huawei products. For insufficient input validation, attackers can craft and send some malformed messages to the target device to exhaust the memory of the device and cause a Denial of Service DoS. Vulnerability ID: HWPSIRT-2016-1210...
Security Advisory - Two Vulnerabilities in H323 protocol of Huawei Products
There is an out-of-bounds read vulnerability in H323 protocol of Huawei products. An unauthenticated, remote attacker may send crafted packets to the affected products. Due to insufficient verification of the packets, successful exploit will cause process reboot. Vulnerability ID:...
Security Advisory - DoS Vulnerability in Some Huawei Products
Some Huawei products have a DoS vulnerability due to insufficient input validation. An attacker could exploit this vulnerability by sending specially crafted NFC messages to the target device. Successful exploit could make a service crash. Vulnerability ID: HWPSIRT-2017-05081 This vulnerability h...
Security Advisory - Integer Overflow Vulnerability in Some Huawei Products
There is an integer overflow vulnerability in some Huawei products. The attacker sends a response message to the device, which contains an illegal length field, it could produce an integer overflow and restart the modem system. Vulnerability ID: HWPSIRT-2017-06005 This vulnerability has been...
Security Advisory - DoS Vulnerability of Audio Driver in Some Huawei Smartphones
Audio driver has a denial of service DoS vulnerability in some Huawei smart phones. An attacker tricks a user into installing a malicious application on the smart phone, and the race condition cause null pointer accessing during the application access shared resource, which make the system reboot...
Security Advisory - Buffer Overflow Vulnerability in Driver of Huawei Smart Phone
The camerafs driver of some Huawei products has buffer overflow vulnerability due to the lack of input validation. An attacker tricks a user into installing a malicious application which has the system privilege of the Android system and sends a specific parameter to the driver of the smart phone...
Security Advisory - Input Validation Vulnerability in Multiple Huawei Products
There is an input validation vulnerability in Huawei Multiple products. Due to the lack of input validation on the device, a remote attacker may exploit this vulnerability by crafting a malformed packet and sending it to the device. A successful exploit could allow the attacker to cause a denial ...
Authentication Bypass Vulnerability in Huawei SkyTone
Huawei SkyTone products have an authentication bypass vulnerability. An unauthenticated attacker may craft specific message to the affected products' server. Due to insufficient authentication, the attacker may bypass the authentication and make some functions abnormal. Vulnerability ID:...
Security Advisory - Improper Permission Control Vulnerability in Huawei Vmall Alert Service
The AlarmService component in Huawei Vmall has no control over calling permissions, allowing any third party to call. An attacker can construct a malicious application to call it. Consequently, alert music will be played suddenly, compromising user experience. Vulnerability ID: HWPSIRT-2016-11067...
Security Advisory - DoS Vulnerability in Multiple Huawei Devices
There is a denial of service DoS vulnerability in multiple Huawei devices. Due to the lack of input validation, a remote attacker may craft a malformed Resource Reservation ProtocolRSVP packet and send it to the device, causing a few buffer overflows and occasional device restart. Vulnerability I...
Security Advisory - Information Leak Vulnerability in Huawei DSM Product
There is a information leak vulnerability in DSM Product. The DSM does not clear the clipboard after data in a secure file opened using the DSM is copied and the secure file is closed. Data in the clipboard can be copied in common documents that do not use the DSM, leading to information leaks...
Security Advisory-Authentication Bypass Vulnerability on E587 Mobile WiFi
Huawei E587 products have an authentication bypass vulnerability that could be exploited by an attacker to graft commands to obtain and change configuration information, send short messages, and restart the device without login Vulnerability ID: HWPSIRT-2015-02001. This Vulnerability has been...
Security Advisory-Memory Overflow Vulnerabilities on Huawei E5332 Webserver
Huawei E5332 wireless router has the following two memory overflow vulnerabilities: Memory overflow occurs when the E5332 Webserver parses a specially crafted HTTP request message, causing the device reboot Vulnerability ID: HWPSIRT-2014-0861. This Vulnerability has been assigned Common...
Security Advisory - Information Leak Vulnerability in Some Huawei Smart Phones
Some Huawei smartphones have an information leak vulnerability due to the lack of permission validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can read some hardware serial number, which may cause sensitive information leak...
Security Advisory - Numeric Errors Vulnerability in Some Huawei Products
Some Huawei products have a numeric errors vulnerability. An unauthenticated, remote attacker may send specially crafted SCCP messages to the affected products. Due to the improper validation of the messages, it will cause numeric errors when handling the messages. Successful exploit will cause...
Security Advisory - Information Disclosure Vulnerability on Honor Smart Scale Application
There is an information disclosure vulnerability on Honor Smart Scale application. The application does not sufficiently restrict the resource which can be accessed by certain protocol. An attacker could trick the user to click a malicious link, successful exploit could cause information...
Security Advisory - DoS Vulnerability in Some Huawei Switch Products
There is a denial of service DoS vulnerability in Some Huawei switch products. An unauthenticated, remote attacker crafts oversized packets and sends the packets to the affected products. Due to insufficient verification of the packets, successful exploitation may cause the service unavailability...
Security Advisory - DoS Vulnerability in Some Huawei Products
Some Huawei products have a DoS vulnerability due to insufficient validation of the Network Quality AnalysisNQA packets. A remote attacker could exploit this vulnerability by sending malformed NQA packets to the target device. Successful exploitation could make the device restart. Vulnerability I...
Security Advisory - Permission Control Vulnerability in Smart Phones
Some Huawei Smart phones have a permission control vulnerability. Due to improper authorization configuration on specific device information, an attacker with the root privilege can exploit this vulnerability to modify specific device information. Vulnerability ID: HWPSIRT-2017-08157 This...
Security Advisory - MITM Vulnerability in Huawei Themes App in Some Mobile Phones
The Themes App in some Huawei mobile phones has a man-in-the-middle MITM vulnerability due to the use of the insecure HTTP protocol for theme download. An attacker may exploit this vulnerability to tamper with downloaded themes. Vulnerability ID: HWPSIRT-2017-06263 This vulnerability has been...
Security Advisory - Out-of-Bounds Memory Access Vulnerability in the Boot Loaders of Huawei Mobile Phones
The boot loaders of some Huawei mobile phones have an out-of-bounds memory access vulnerability due to the lack of parameter validation. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause buffer...
Security Advisory - Use After Free Vulnerability in TEE Module of Some Huawei Smart Phones
The Trusted Execution Environment TEE module driver of some Huawei smart phones has a use after free UAF vulnerability. An attacker tricks a user into installing a malicious application, and the application can start multiple threads and try to create and free specific memory, which could trigger...
Security Advisory - Two Buffer Overflow Vulnerabilities in the GaussDB
There is a buffer overflow vulnerability in the type conversion function of the GaussDB. An attacker logs in to the system as a common user and craft malformed packets, which could be exploited to perform a denial of service attack or possibly remote code execution on the GaussDB. Vulnerability I...
Security Advisory - Plaintext Storage of Users’ Safe Passwords in the Files APP in Huawei Mobile Phones
The Files APP in some Huawei mobile phones has a vulnerability of plaintext storage of users' Safe passwords. An attacker with the root privilege of an Android system could forge the Safe to read users' plaintext Safe passwords, leading to information leak. Vulnerability ID: HWPSIRT-2017-03222 Th...
Security Advisory - Exposed System Interface Vulnerability on Huawei Smart Phones
There is a exposed system interface vulnerability on smart phones. The software provides a system interface for interaction with external applications, but calling the interface is not properly restricted. An attacker could trick the user into installing a malicious application to call the...
Security Advisory - Privilege Escalation Vulnerability in Huawei Smart Phones
There is a privilege escalation vulnerability in Huawei smart phones. An unauthenticated attacker can bypass phone activation to user management page of the phone and create a new user. Successful exploit could allow the attacker operate part function of the phone. Vulnerability ID:...
Security Advisory - Buffer Overflow Vulnerability in Emergdata Driver of Huawei Smart Phones
The emergdata driver of some Huawei smart phones has a buffer overflow vulnerability due to the lack of a parameters check. An attacker with the root privilege of the Android system can tricks a user into installing a malicious application on the smart phone, and send given parameter to smart pho...
Security Advisory - Phone Activation Bypass Vulnerability in Huawei Smartphones
There is a phone activation bypass vulnerability in Huawei smartphones. Successful exploit could allow an unauthenticated attacker to bypass phone activation to settings page of the phone. Vulnerability ID: HWPSIRT-2016-12004 This vulnerability has been assigned CVE ID: CVE-2017-2705. Huawei has...
Security Advisory - Buffer Overflow Vulnerability in Wi-FI Driver of Huawei Smart Phone
The Wi-Fi driver of some Huawei products has buffer overflow vulnerability due to the lack of a parameters check. An attacker can tricks a user into installing a malicious application on the smart phone, and send given parameter to smart phone to crash the system or escalate privilege...
Security Advisory - DoS Vulnerability in Huawei Firewall
There is a denial of service DoS vulnerability in Huawei firewalls due to no memory release after the execution of a specific command. A remote attacker with specific permission can log in to a device and deliver a large number of such commands to exhaust memory, causing a DoS condition...
Security Advisory - DOS Vulnerability in ION Memory Management Module of Huawei Smart Phone
A denial of service DoS vulnerability exists in the ION memory management module of some Huawei mobile phones. An attacker may trick a user into installing a malicious app to send specific parameters to a Huawei mobile phone. Successful exploit could cause the system to restart.Vulnerability ID:...
Security Advisory - Input Validation Vulnerability in WiFi Driver of Huawei Smart Phone
There is an input validation vulnerability in the WiFi driver of some Huawei products. An attacker may trick a user into installing a malicious application, and the application can send given parameter to WiFi driver to crash the system or escalate user privilege. Vulnerability ID:...
Security Advisory - XSS Vulnerability in the Email App of Huawei Smartphone
There is a vulnerability due to the lack of output encoding for some particular characters in the email APP built in the affected Smart Phones. A successful exploitation of the vulnerability could allow an unauthenticated remote attacker to perform a cross-site scripting XSS attack and lead to...
Security Advisory - Input Check Vulnerability in Huawei Smart Phone
There is a vulnerability in a Huawei smart phone that does not validate input parameter. The attacker tricks the user to install a malicious application to obtain system or camera privilege and then can exploit the vulnerability to make the product system panic. Vulnerability ID: HWPSIRT-2015-110...
Security Advisory - DoS Vulnerabilities in JPU Driver of Huawei Products
There are two Denial of Service DoS vulnerabilities in Joint Photographic Experts Group Processing Unit JPU drivers of some Huawei products. An attacker who tricks a user into installing a malicious application which has the system or camera permission may input invalid parameters into the JPU...
Security Advisory - Input Validation Vulnerability in Huawei VP9660 Products
VP9660 is the multi-point control unit of Huawei Video Conference system. The server of the Huawei VP9660 does not validate the input when using build-in WebServer. In such case, an attacker could log in to the device as an business administrator, graft a message to change the specific informatio...
Security Advisory - DHCP Snooping Vulnerability in Huawei Multiple Products
Multiple Huawei products have "DHCP Snooping" function. When the "option82 insert" or "option82 rebuild" is enabled on interface, the device is not able to parse some specific DHCP packet correctly, making the device restart. Vulnerability ID：HWPSIRT-2015-08052 This vulnerability has been assigne...
Security Advisory-Two Security Vulnerabilities in the ME906 Wireless Module
ME906 is a mobile Internet access module. The module supports LTE, WCDMA, EVDO, and GSM. The product uses the M.2 interface, supports Windows 7 and Windows 8.1, and is intended for laptop and tablet OEM. This security advisory SA describes the impact of two vulnerabilities. These vulnerabilities...
Security Advisory-Resource Management Vulnerability in the AR1220
Under Specifically configurations in the AR1220, An attacker sends massive traffic to the FE port from the GE port on the main board. As a result, the interface board resets unexpectedly. Vulnerability ID: HWPSIRT-2014-1298. This Vulnerability has been assigned Common Vulnerabilities and Exposure...
Security Advisory-Improper Input Validation Vulnerability on Multiple Quidway Switch Products
Reported by the internal R&D engineers, several switch products does not validate the input properly. This vulnerability enables attacker to launch DoS attack by crafting and sending malformed packet to these vulnerable products Vulnerability ID: HWPSIRT-2014-0301. This Vulnerability has been...
Security Advisory - Use after Free Vulnerability in Huawei Product
There is a use after free vulnerability on Huawei smartphones. A module does not deal with specific message properly, which makes a function refer to memory after it has been freed. Attackers can exploit this vulnerability by running a crafted application with common privilege. This would...
Security Advisory - Denial of Service Vulnerability in Several Smartphones
There is a denial of service vulnerability in several smartphones. The system does not properly limit the depth of recursion, an attacker should trick the user installing and execute a malicious application. Successful exploit could cause a denial of service condition. Vulnerability ID:...
Security Advisory - Insufficient Authentication Vulnerabilities in Some Huawei Smart Phone Product
There is an insufficient authentication vulnerability in some Huawei smart phone. An unauthenticated, local attacker can crafts software package to exploit this vulnerability. Due to insufficient verification, successful exploitation may impact the service. Vulnerability ID: HWPSIRT-2019-12302 Th...
Security Advisory - Privilege Escalation Vulnerability in Huawei PCManager Product
There is a privilege escalation vulnerability in Huawei PCManager products. An authenticated, local attacker can perform specific operation to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege. Vulnerability ID: HWPSIRT-2019-10117 This...
Security Advisory - Information Leakage Vulnerability on Some Smart Phones
There is an information leakage vulnerability on some Huawei smart phones. An attacker tricks the user into installing a malicious application, which can copy specific files to the sdcard, resulting in information leakage. Vulnerability ID: HWPSIRT-2019-04072 This vulnerability has been assigned ...
Security Advisory - Double Free Vulnerability in Some Huawei Smart Phones
There is a double free vulnerability in some Huawei smart phones. An attacker can trick a user to click a URL to exploit this vulnerability. Successful exploitation may cause the affected phone abnormal. Vulnerability ID: HWPSIRT-2019-04065 This vulnerability has been assigned a Common...
Security Advisory - Out-of-bounds Write Vulnerability on Several Smartphones
There is an out-of-bounds write vulnerability on several smartphones. The software does not handle the response message properly when the user doing certain inquiry operation, an attacker could send crafted message to the device, successful exploit could cause a denial of service condition...
Security Advisory - Information Leak Vulnerability in Some Huawei Smart Phones
Some Huawei phones have an information leak vulnerability. Due to improper permission settings for specific commands, attackers who can connect to a mobile phone via the USB interface may exploit this vulnerability to obtain specific device information of the mobile phone. Vulnerability ID:...
Security Advisory - Information Leakage Vulnerability on Huawei Smart Phone
There is an information leakage vulnerability. Because an interface does not verify authorization correctly, attackers can exploit an application with the authorization of phone state to obtain user location additionally. Vulnerability ID: HWPSIRT-2018-03117 This vulnerability has been assigned a...