1006 matches found
Security Advisory-Web server vulnerabilities on Huawei E585 pocket Wi-Fi 2 device
HUAWEI E585 Wireless Modem is the terminal which can realize the high-speed wireless network access. The access is realized by the connection between USB interfaces and PCs or by the connection between WiFi and many wireless devices. In the network coverage area of HSPA/UMTS or EDGE/GPRS/GSM, use...
Security Advisory - Misinterpretation of Input Vulnerability in Huawei Printer
There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.Vulnerability ID:HWPSIRT-2022-78037 This vulnerability has been assigned a CVE ID: CVE-2022-48261...
Security Advisory - Code Execution Vulnerability in Fastjson Affect Several Huawei Products
There is a code execution vulnerability in Fastjson affect several Huawei products. Fastjson is an opensource JSON parsing library, successful exploit could allow the attacker bypass the limit of autoType then execute code. Vulnerability ID: HWPSIRT-2020-05962 Huawei has released software updates...
Security Advisory - Information Disclosure Vulnerability in Several Products
There is an information disclosure vulnerability in several products. A logic judgment error occurs when the system handling Bluetooth connections, an attacker could craft as an authenticated Bluetooth peer to launch the attack. Successful exploit could cause information disclosure. Vulnerability...
Security Advisory - Improper Authentication Vulnerability in Huawei Smartphone
There is an improper authentication vulnerability in some Huawei smartphone. Authentication to target component is improper when device performs an operation. Attackers exploit this vulnerability to obtain some information by loading malicious application, leading to information leak. Vulnerabili...
Security Advisory - Double Free Memory Vulnerability in Huawei Products
There is a vulnerability that the IPSec module handles a message improperly. Attackers can send specific message to cause double free memory. This may compromise normal service. Vulnerability ID: HWPSIRT-2019-12420 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID...
Security Advisory - Use After Free Vulnerability on Several Smartphones
There is a use after free vulnerability on certain driver component in smartphone. An attacker tricks the user into installing a malicious application, which make the software to reference memory after it has been freed. Successful exploit could cause a denial of service condition. Vulnerability...
Security Advisory - Weak Algorithm Vulnerability in Some Huawei Products
There is a weak algorithm vulnerability in some Huawei products. To exploit the vulnerability, a remote, unauthenticated attacker has to capture TLS traffic between clients and the affected products. The attacker may launch the Bleichenbacher attack on RSA key exchange to decrypt the session key...
Security Advisory - Privilege Escalation Vulnerability in Some Huawei Smart Phones
Some Huawei smart phones has a privilege escalation vulnerability. An authenticated, local attacker can crafts malformed packets after tricking a user to install a malicious application and exploit this vulnerability when in the exception handling process. Successful exploitation may cause the...
Security Advisory - Invalid Memory Access Vulnerability in Some Huawei Products
There is an invalid memory access vulnerability in some Huawei products. An unauthenticated attacker has to find a way to send malformed SCCP messages to the affected products. Due to insufficient input validation of some values in the messages, successful exploit may cause buffer error and some...
Security Advisory - Authentication Bypass Vulnerability in Some Pre-installed Apps on Huawei Phones
There is an authentication bypass vulnerability in some pre-installed apps on Huawei mobile phones due to insufficient validation on invocation requests. An attacker may trick a user into installing a malicious app which can invoke the open interfaces of the vulnerable apps to install any apps...
Security Advisory - Information Leak Vulnerability in Some Huawei Products
There is an information leak vulnerability in the NFC Near Field Communication module of some Huawei mobile phones. The attacker has to trick a user to do some specific operations and then craft the NFC message to exploit this vulnerability. Successful exploit will cause some information leak...
Security Advisory - Buffer Overflow Vulnerability in Some Huawei Products
Some Huawei products have a buffer overflow vulnerability due to incomplete range checks of the input data. An unauthenticated, remote attacker could exploit this vulnerability by sending malicious IKE packets to the targeted device. An exploit could allow the attacker to cause the device to writ...
Security Advisory - DoS Vulnerability in Huawei Firewall Products
There is a DoS vulnerability in some Huawei firewall products. Due to insufficient input validation, a remote attacker who controls the peer device could exploit the vulnerability by sending malformed IKE packets to the target device. Successful exploit of the vulnerability could cause the device...
Security Advisory - Privilege Escalation Vulnerability in Huawei ME906S Products
There has a privilege elevation vulnerability in ME906S Products. Due to lack of privilege restrictions on some of the business functions of the device. An attacker could exploit this vulnerability to modify the configuration information containing malicious files and trick users into executing t...
Security Advisory - Permission Control Vulnerability in Smart Phones
Some Huawei Smart phones have a permission control vulnerability. Due to improper authorization on specific processes, an attacker with the root privilege of a mobile Android system can exploit this vulnerability to obtain some information of the user. Vulnerability ID: HWPSIRT-2017-04123 This...
Security Advisory - Memory Double Free Vulnerability in Touch Panel Driver of Some Huawei Smart Phones
The Touch Panel TP driver of some Huawei smart phones has a memory double free vulnerability. An attacker with the root privilege of the Android system tricks a user into installing a malicious application, and the application can start multiple threads and try to free specific memory, which coul...
Security Advisory - Plaintext Storage of Users’ Safe Passwords in the Files APP in Huawei Mobile Phones
The Files APP in some Huawei mobile phones has a vulnerability of plaintext storage of users' Safe passwords. An attacker with the root privilege of an Android system could forge the Safe to read users' plaintext Safe passwords, leading to information leak. Vulnerability ID: HWPSIRT-2017-03222 Th...
Security Advisory - DoS Vulnerability in Some Huawei Products
There is a denial of service DoS vulnerability in some Huawei smart phones due to the input parameters validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can send given parameter to specific interface, which make a large number of...
Security Advisory - Improper Permission Control Vulnerability in Huawei Vmall Alert Service
The AlarmService component in Huawei Vmall has no control over calling permissions, allowing any third party to call. An attacker can construct a malicious application to call it. Consequently, alert music will be played suddenly, compromising user experience. Vulnerability ID: HWPSIRT-2016-11067...
Security Advisory - Buffer Overflow Vulnerability in TP Driver of Huawei Smart Phone
Touch Panel TP driver of some Huawei products have one buffer overflow vulnerability due to the lack of a parameters check. An attacker can get ROOT privilege and to send given parameter to TP driver to crash the system or execute arbitrary code. Vulnerability ID: HWPSIRT-2016-05224 This...
Security Advisory - Privilege Escalation Vulnerability in the FusionStorage
FusionStorage is a piece of distributed block storage software specifically designed for the storage infrastructure of cloud computing data centers. The maintenance module of Huawei FusionStorage has a privilege escalation vulnerability. After logging in to the FusionStorage successfully as a...
Security Advisory - Buffer Overflow Vulnerability in Huawei USG Products
The Point-to-Point Protocol over Ethernet PPPoE module of the USG has a buffer overflow vulnerability. When Challenge Handshake Authentication Protocol CHAP authentication is configured on the server, an attacker may send abnormal attack packets to the server during authentication to cause buffer...
Security Advisory - Cleartext Storage of Crytographic Key Vulnerability in FusionCompute
FusionCompute has a key cleartext storage vulnerability. Successful exploit could allow an attacker to obtain AES keys. Vulnerability ID: HWPSIRT-2016-06076 This vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID: CVE-2016-6827. Huawei has released software updates to fix...
Security Advisory - Token Transmission in Plaintext Vulnerability in OceanStor Products
The OceanStor 5300 V3/5500 V3/5600 V3/5800 V3/6800 V3/ 18800 V3/18500 V3 are mid-range and high-end storage products newly developed by Huawei Technologies Co., Ltd Huawei for short. This series is ideal for processing existing storage applications and follows the future development trend of...
Security Advisory - Integrity Protection Vulnerability in Huawei E3276s Products
The Huawei E3276s products have an integrity protection vulnerability. As a result, user communication can be intercepted, spoofed, and injected with traffic. Vulnerability ID: HWPSIRT-2016-02019 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2016-3676...
Security Advisory - DoS Vulnerability in Huawei LogCenter
Huawei LogCenter has a DoS vulnerability. After login to the LogCenter, an attacker can add abnormal device information to the log collection module. The LogCenter system does not verify input device information. As a result, the log collection module denies services. Vulnerability ID:...
Security Advisory - VCN500 SQL Injection Vulnerability
The operation and maintenance unit OMU of Huawei VCN500 Video Cloud Node does not validate parameters of received HTTP requests, which allows an attacker to launch the SQL injection attack against VCN500 by sending manually crafted packets. Vulnerability ID: HWPSIRT-2015-09016 This vulnerability...
Security Advisory - Improper User Privileges Vulnerability in VCN500
The operation and maintenance unit OMU of Huawei VCN500 Video Cloud Node does not configure user privileges properly. By exploiting this vulnerability, ordinary users can modify the IP address of the media server in system management by sending specially crafted packets to the OMU interface,...
Security Advisory - mDNS Message Improper Handling Vulnerability in Huawei WLAN AC Products
The mDNS module in Huawei WLAN AC products improperly processes mDNS packets and responds to mDNS unicast queries from outside the link local network e.g., the WAN, leading to information leaks.Vulnerability ID: HWPSIRT-2015-03024 The CVE No. of the vulnerability is CVE-2015-6586...
Security Advisory-Information Disclosure Vulnerability on E355s Mobile WiFi
E355s have an information disclosure vulnerability that could be exploited by an attacker to graft attack commands or capture network communications to obtain the configuration and user information without login Vulnerability ID: HWPSIRT-2015-02002. This Vulnerability has been assigned Common...
Security Advisory-Improper Input Validation Vulnerability on Multiple Quidway Switch Products
Reported by the internal R&D engineers, several switch products does not validate the input properly. This vulnerability enables attacker to launch DoS attack by crafting and sending malformed packet to these vulnerable products Vulnerability ID: HWPSIRT-2014-0301. This Vulnerability has been...
Security Advisory-Vulnerability in Image Upload of User-defined Devices to Huawei eSight System
Huawei eSight System is an operation and maintenance system that Huawei develops for next-generation wireless/wired enterprise campus networks, enterprise branches, and data centers. When users adapt new devices for it, the server verifies the format of the files to be uploaded unsuccessfully...
Security Advisory-HTTP Session Management Vulnerability in HTTP Module
Branch Intelligent Management System BIMS and Web management is provided by Huawei for network and device management. Both BIMS and Web management use HTTP. Therefore, to use BIMS and Web management, you must enable HTTP. Because HTTP session ID generation is weak and predictable, an attacker can...
Security Advisory - Buffer Overflow Vulnerability in Huawei Smartphone
There is a buffer overflow vulnerability in Huawei smartphone. A module does not verify the some input when dealing with messages. Attackers can exploit this vulnerability by sending malicious input through specific module. This could cause buffer overflow, compromising normal service...
Security Advisory - Use after Free Vulnerability in Huawei Product
There is a use after free vulnerability on Huawei smartphones. A module does not deal with specific message properly, which makes a function refer to memory after it has been freed. Attackers can exploit this vulnerability by running a crafted application with common privilege. This would...
Security Advisory - Resource Management Error Vulnerability in Huawei CloudEngine 1800V Product
CloudEngine 1800V product has a resource management error vulnerability. Remote unauthorized attackers could send specific types of messages to the device, resulting in the message received by the system can't be forwarded normally. Vulnerability ID: HWPSIRT-2020-86502 This vulnerability has been...
Security Advisory - Information Leak Vulnerability in Huawei Products
There is an information leak vulnerability in Huawei FusionCompute. A module does not launch strict access control and information protection. Attackers with low privilege can get some extra information. This can lead to information leak. Vulnerability ID: HWPSIRT-2020-05037 This vulnerability ha...
Security Advisory - Out Of Bound Read Vulnerability in Huawei Smartphone
There is an out of bound read vulnerability in Huawei smartphones. Some functions are lack of verification when they process some messages sent from other module. Attackers can exploit this vulnerability by send malicious message to cause out-of-bound read. This can compromise normal service...
Security Advisory - Insufficient Authentication Vulnerabilities in Some Huawei Smart Phone Product
There is an insufficient authentication vulnerability in some Huawei smart phone. An unauthenticated, local attacker can crafts software package to exploit this vulnerability. Due to insufficient verification, successful exploitation may impact the service. Vulnerability ID: HWPSIRT-2019-12302 Th...
Security Advisory - Information Disclosure Vulnerability in Several Smartphones
There is an information disclosure vulnerability in several smartphones. Certain function's default configuration in the system seems insecure, an attacker should craft a WI-FI hotspot to launch the attack. Successful exploit could cause information disclosure. Vulnerability ID: HWPSIRT-2019-1010...
Security Advisory - Information Disclosure Vulnerability in Several Smartphones
There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker need to gain certain information in the victim's smartphone to launch the attack, successful exploit...
Security Advisory - Privilege Escalation Vulnerability in Huawei PCManager Product
There is a privilege escalation vulnerability in Huawei PCManager products. An authenticated, local attacker can perform specific operation to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege. Vulnerability ID: HWPSIRT-2019-10117 This...
Security Advisory - FRP Bypass Vulnerability on Smartphones
There is a Factory Reset Protection FRP bypass vulnerability on some Huawei smartphones. The system does not sufficiently verify the permission, an attacker uses a data cable to connect the smartphone to the computer and then perform some specific operations. Successful exploit could allow the...
Security Advisory - Stored XSS Vulnerability in eSpace Desktop
There is a stored cross-site scripting XSS vulnerability in eSpace Desktop. Due to the insufficient validation of the input, an authenticated, remote attacker could exploit this vulnerability to send abnormal messages to the system and perform a XSS attack. A successful exploit could cause the...
Security Advisory - Buffer Error Vulnerability in Some Huawei Products
There are a buffer error vulnerability in Electronic Numbers to URI Mapping ENUM module some Huawei products. An unauthenticated, remote attacker has to control the peer device and send specially crafted ENUM packets to the affected products. Due to insufficient verification of some values in the...
Security Advisory - Invalid Memory Access Vulnerability in Some Huawei Products
There is an invalid memory access vulnerabilities in SCCPX module of some Huawei products. An unauthenticated, remote attacker may send specially crafted packets to the affected products. Due to insufficient validation of packets, successful exploit may cause some services abnormal. Vulnerability...
Security Advisory - Weak Algorithm Vulnerability on Huawei Products
There is a weak encryption algorithm security vulnerability in the DBS3900 TDD LTE. DBS3900 TDD LTE supports SSL/TLS protocol negotiation using insecure encryption algorithms. If an insecure encryption algorithm is negotiated in the communication, an unauthenticated remote attacker can exploit th...
Security Advisory - Buffer Error Vulnerability in Some Huawei Products
There is a buffer overflow vulnerability in the SCCP Signalling Connection Control Part module of some Huawei products. An attacker has to find a way to send malformed packets to the affected products repeatedly. Due to insufficient input validation, successful exploit may cause some service...
Security Advisory - Directory Traversal Vulnerability in Huawei eSpace Product
There is a directory traversal vulnerability in Huawei eSpace product. An authenticated, remote attacker can craft specific URL to the affected products. Due to insufficient verification of the URL, successful exploit will upload and download files and cause information leak and system crash...