1030 matches found
Security Advisory - Memory Double Free Vulnerability in GPU Driver of Some Huawei Smart Phones
The GPU driver of some Huawei smart phones has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can call special API, which could triggers double free and causes a system crash or arbitrary code execution. Vulnerability ID:...
Security Advisory - Two Buffer overflow Vulnerabilities on Huawei Smart Phone
Some Huawei smart phones have two buffer overflow vulnerabilities due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege; the APP can send a specific parameter to the smart phone, causing the smartphone restart or arbitrary...
Security Advisory - Integer Overflow Vulnerability in the OceanStor 5800
The OceanStor 5800 V3 Storage Systems are mid-range storage products newly developed by Huawei. The OceanStor 5800 has an integer overflow vulnerability. An authenticated attacker may send massive abnormal Network File System NFS packets, causing an anomaly in specific disk arrays. Vulnerability...
Security Advisory - Memory Leak Vulnerability in Several Huawei Products
There is a vulnerability in several Huawei devices: USG series, NGFW module, IPS module, NIP series and AntiDDoS8000. A memory leak vulnerability exists in these products. In hot standby networking where two devices are not directly connected, an attacker can craft a malformed packet, which...
Security Advisory - Integrity Protection Vulnerability in Huawei E3276s Products
The Huawei E3276s products have an integrity protection vulnerability. As a result, user communication can be intercepted, spoofed, and injected with traffic. Vulnerability ID: HWPSIRT-2016-02019 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2016-3676...
Security Advisory - Integer Overflow Vulnerability in Graphics Driver of Huawei Smart Phone
Graphics drivers of some Huawei smart phones have a integer overflow issue due to the lack of a parameters check, which lead to a further heap overflow vulnerability. An attacker may trick a user into installing a malicious application and application can exploit the vulnerability to crash the...
Security Advisory - mDNS Message Improper Handling Vulnerability in Huawei WLAN AC Products
The mDNS module in Huawei WLAN AC products improperly processes mDNS packets and responds to mDNS unicast queries from outside the link local network e.g., the WAN, leading to information leaks.Vulnerability ID: HWPSIRT-2015-03024 The CVE No. of the vulnerability is CVE-2015-6586...
Security Advisory - Integer Overflow Vulnerability on Smartphones
There is an integer overflow vulnerability on smartphones. The software does not process certain variable properly when handle certain process. An attacker tricks the user who has root privilege to install a crafted application, successful exploit could cause information disclosure. Vulnerability...
Security Advisory - Authentication Bypass Vulnerability in the 'Find Phone' Function of Some Huawei Smart Phones
There is an authentication bypass vulnerability in the 'Find Phone' function of some Huawei smart phone. Due to improper authentication realization in the 'Find Phone' function. An attacker may exploit the vulnerability to bypass the 'Find Phone' function in order to use the phone normally...
Security Advisory - Type Confusion Vulnerability on Huawei Smartphones
There is a type confusion vulnerability on Huawei smartphones. The program initializes a variable using one type, but it later accesses that variable using a type that is different with the original type when do certain register operation. Successful exploit could result in buffer overflow then m...
Security Advisory - Use After Free Vulnerability in Bastet Driver of Some Huawei Smart Phones
The Bastet Driver of some Huawei smart phones has a use after free UAF vulnerability. An attacker can convince a user to install a malicious application which has a high privilege to exploit this vulnerability, Successful exploitation may cause arbitrary code execution. Vulnerability ID:...
Security Advisory - Two Privilege Escalation Vulnerabilities in the GaussDB
There is a privilege escalation vulnerability in the validator functions of the GaussDB. An attacker may log in to the system as a low-privilege user and execute the high-privilege functions. Then, the attacker may obtain the high-privilege of the GaussDB and crash the system. Vulnerability ID:...
Security Advisory - Information Leak Vulnerability in Some Huawei Smart Phones
Some Huawei smartphones have an information leak vulnerability due to improper file permission configuration. An attacker tricks a user into installing a malicious application on the smart phone, and the application can get the file that keep the cipher text of the SIM card PIN. Vulnerability ID:...
Security Advisory - Resource Management Vulnerability in Huawei Servers
Some Huawei servers have a resource management vulnerability in the iBMC Intelligent Baseboard Management Controller. A local attacker could exploit this vulnerability to exhaust iBMC resources and cause a denial of service. Vulnerability ID: HWPSIRT-2016-05251 This vulnerability has been assigne...
Security Advisory - Information Leak Vulnerability in Huawei FusionSphere Product
The open-source component Xenstore in the FusionSphere has an information leak vulnerability due to loose security settings. Successful exploit could allow an authenticated attacker to obtain partial information from virtual machines. Vulnerability ID: HWPSIRT-2016-06067. Huawei has released...
Security Advisory - Information Disclosure Vulnerability in the DSM
Huawei Document Security Management DSM provides document permission control. A vulnerability in the permission control module of DSM could lead to incorrect control over specific permissions on encrypted documents. Vulnerability ID：HWPSIRT-2015-12030 This vulnerability has been assigned Common...
Security Advisory - App Validity Check Bypass Vulnerability in Huawei P7 Smartphone
The PackageInstaller module on Huawei smartphone P7 has a vulnerability in validity check of third-party apps. Attackers can configure some specific information in the malware packages so that smartphones consider that the package is downloaded from whitelisted websites. As a result, the malware...
Security Advisory-XSS Security Vulnerability on Huawei E355
Huawei E355 portable 3G wireless routers have the stored cross-site scripting XSS vulnerability. Attackers can exploit the vulnerability to plant malicious scripts into the configuration file to interrupt the services of legitimate users. Vulnerability ID: HWPSIRT-2014-0516 The CVE No. of the...
Security Advisory - Buffer Overflow in Huawei UTPS Back-End
The back-end software UTPS is the application software which is operated on the management data card of PC to realize the configuration and dial-up connection of data card, instant messages receiving and sending, telephone directory management and the like. The current product has a vulnerability...
Security Notice - Statement on Remote Code Execution Vulnerability in Fastjson2
Following the discovery of the remote code execution vulnerability in Fastjson2, Huawei has launched an immediate investigation. Attackers controlling JSON requests can exploit this vulnerability to execute arbitrary code on the target server. The investigation is completed. If you have deployed...
Security Notice - Statement on Remote Code Execution Vulnerability in Fastjson
Huawei has recently realized the Remote Code Execution RCE vulnerability in Fastjson. A remote attacker can exploit this vulnerability by sending crafted JSON data. Successful exploitation of this vulnerability may lead to remote code execution. If you have deployed Huawei Next-Generation Firewal...
Security Advisory - OS Command Injection Vulnerability in Huawei EnzoH Products
EnzoH has an OS command injection vulnerability. Successful exploitation of this vulnerability may lead to arbitrary command execution.Vulnerability ID:HWPSIRT-2024-64643 This vulnerability has been assigned a CVE ID: CVE-2024-58255...
Security Advisory - Authentication Bypass Vulnerability in Some Huawei Smart Phones
Some Huawei smart phones have an authentication bypass vulnerability due to the improper design of a component. An attacker who get a user's smart phone can execute specific operation, and delete the fingerprint of the phone without authentication. Vulnerability ID: HWPSIRT-2017-10094 This...
Security Advisory - Information Leak Vulnerability in Some Huawei Smart Phones
Some Huawei smartphones have an information leak vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can read some sensitive information in kernel memory, which may cause sensitive...
Security Advisory - Data Leak Vulnerability in the FusionCompute
The FusionCompute is a cloud operating system OS. It virtualizes computing, storage, and network resources, and implements centralized management and scheduling of the virtual resources through a unified interface. Huawei FusionCompute has sensitive data leak vulnerability. An attacker can log in...
Security Advisory - Privilege Escalation Vulnerability in Huawei Policy Center
Huawei Policy Center dynamically allocates network resources in a unified manner, enabling the network to provide services with more agility. Huawei Policy Center has a privilege escalation vulnerability. An attacker could log in to the device as a low-privilege user, craft a URL that contains...
Security Advisory - Baidu WormHole Vulnerability in Huawei Mobile Phones
Preinstalled Baidu apps in certain Huawei mobile phones have the WormHole vulnerability. An attacker can exploit this vulnerability to read information about, modify data in, or take control over the affected mobile phones. Vulnerability ID: HWPSIRT-2015-10045 Huawei has released software updates...
Security Advisory-Vulnerability in Image Upload of User-defined Devices to Huawei eSight System
Huawei eSight System is an operation and maintenance system that Huawei develops for next-generation wireless/wired enterprise campus networks, enterprise branches, and data centers. When users adapt new devices for it, the server verifies the format of the files to be uploaded unsuccessfully...
Security Advisory - Integer overflow Vulnerability in Bdat Driver of Huawei Smart Phone
The Bdat driver of some Huawei smart phones has integer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP and execute it as a specific privilege; the APP can send a specific parameter to the driver of the smart phone, causing...
Security Advisory - DoS Vulnerability in Some Huawei Smart Phones
There is a denial of service DoS vulnerability in some Huawei smart phones. An attacker can trick a user to install a malicious application to exploit this vulnerability. Successful exploitation can cause camera application unusable. Vulnerability ID: HWPSIRT-2017-09006 This vulnerability has bee...
Security Advisory - Denial of Service Vulnerability on Huawei Smartphones
There is a denial of service vulnerability on Huawei Smartphones. An attacker could make an loop exit condition that cannot be reached by sending the crafted 3GPP message. Successful exploit could cause the device to reboot. Vulnerability ID: HWPSIRT-2017-09085 This vulnerability has been assigne...
Security Advisory - Information Disclosure Vulnerability in AEE extension of MTK Platform
There is an information disclosure vulnerability in AEE extension of MTK Platform used in Huawei smart phones. Due to improper privilege validation on specific processes, an attacker who tricks a user into installing a malicious application on the smart phone can exploit this vulnerability to...
Security Advisory-Radius Vulnerability on Some Huawei Devices
On huawei Campus Switch, AR, SRG,WLAN devices, the RADIUS component cannot handle malformed RADIUS packets. This vulnerability allows attackers to repeatedly restart the device, causing a DoS attack Vulnerability ID: HWPSIRT-2014-0307. This Vulnerability has been assigned Common Vulnerabilities a...
Security Advisory- BootRom Menu and Boot Menu Vulnerabilities on Huawei Campus Switches
Some versions of Huawei Campus S7700/S9300/S9700 switches are affected by the BootRom and Boot Menu vulnerability. 1. Unauthorized users are allowed to upgrade the bootrom or bootload software. Vulnerability ID: HWPSIRT-2014-0315 2. The BootRom Menu vulnerability allows unauthorized users to bypa...
Security Advisory - Stack Overflow Vulnerabilities in SNMPv3 debugging mode
Simple Network Management Protocol version 3SNMPv3 is provided by Huawei for network and device management. While the SNMPv3 is enable and debugging is turn on, attackers can make stack overflow by sending malformed SNMPv3 messages with shellcode encoded, and attack vulnerable equipment remotely...
Security Advisory - DoS Vulnerability in Some Huawei Smart Phones
There is a denial of service DoS vulnerability in some Huawei smart phones. An attacker can trick a user to install a malicious application to exploit this vulnerability. Due to insufficient verification of the parameter, successful exploitation can cause the smartphone black screen until...
Security Advisory - Memory Leak Vulnerability in Several Huawei products
There is a memory leak vulnerability in several Huawei products. An unauthenticated, remote attacker could craft malformed packets with specific parameters when connecting with the affect products by SFTP/SSH protocol. Due to insufficient validation of packets, successful exploit could cause a...
Security Advisory - Two Vulnerabilities in CRYPTO module of Several Huawei Products
There is a buffer overflow vulnerability in the CRYPTO module of several Huawei products. An unauthenticated, local attacker could craft malformed file with a specific field that the length is longer than the maximum value. Due to insufficient validation of the inputs, successful exploit could...
Security Advisory - Double Free Vulnerability in Flp Driver of Some Huawei Smart Phones
The Flp Driver of some Huawei smart phones has a double free vulnerability. An attacker can trick a user to install a malicious application which has a high privilege to exploit this vulnerability. Successful exploitation may cause denial of service DoS attack. Vulnerability ID: HWPSIRT-2017-0813...
Security Advisory - SQL Injection Vulnerabilities in Huawei UMA Product
There is a SQL injection vulnerability in the operation and maintenance module of Huawei UMA Product. An attacker logs in to the system as a common user and sends crafted HTTP requests that contain malicious SQL statements to the affected system. Due to a lack of input validation on HTTP requests...
Security Advisory - No Authentication Vulnerability on the Serial Port of the UAP2105
The UAP2105 serves as a radio access device in the uBro solutions. As one of the AP series products developed on the basis of 3GPP R99/R4/R5/R6 FDD, the UAP2105 complies with the R8 HNB standard and provides Small Office and Home Office SOHO and home users with improved indoor coverage. With the...
Security Advisory - Out-Of-Bounds Read Vulnerability in Some Huawei Products
Some Huawei products have an out-of-bounds read vulnerability. An unauthenticated attacker may send specific crafted H.323 packets to the affected products. Due to insufficient verification of the packets, successful exploit will cause device to reset. Vulnerability ID: HWPSIRT-2017-06160 Huawei...
Security Advisory - Information Disclosure Vulnerability on Huawei Smartphones
There is an information disclosure vulnerability on Huawei smartphones. An attacker tricks the user to install a crafted application, this application simulate click action to back up data in a non-encrypted way using an Android assist function. Successful exploit could result in information...
Security Advisory - Multiple Vulnerabilities in MTK Platform
There are multiple vulnerabilities in the graphics driver of MTK platform in Huawei smart phones. The graphics driver has two buffer overflow vulnerabilities due to the insufficient input verification. An attacker tricks a user into installing a malicious application which has the system privileg...
Security Advisory - Multiple Vulnerabilities in MTK Platform
There are multiple vulnerabilities in MTK platform used in Huawei smart phones. There is a integer overflow vulnerability in MTK platform used in Huawei smart phones. An attacker tricks a user into installing a malicious application on the smart phone, and send given parameter to escalate...
Security Advisory - DoS Vulnerability in Huawei CE Series Switches
Huawei CE series switches are high-performance switches designed for next-generation data centers. The CE series switches have a DoS vulnerability. An attacker logs in to the switches multiple times using a non-administrator account through a specific protocol to exploit this vulnerability...
Security Advisory - DoS Vulnerability in Huawei U1900 Products
Huawei eSpace U1900 switch series provides professional IP voice solutions to meet communications requirements from various enterprises of different sizes. Huawei eSpace U1900 series includes eSpace U1910, U1911, U1930, U1960, U1980, and U1981. A vulnerability exists in a module of U1900 series...
Security Advisory-A DoS Vulnerability in the SSH Module on Huawei AR Router
On Some Huawei AR routers that receive a large number of SSH authentication attack packets with malformed data, legitimate users fail to log in through SSH. Attackers can construct massive attack packets to cause the AR routers to deny SSH login from legitimate users. HWPSIRT-2013-1255. This...
Security Advisory-Vulnerability of Session ID not Updating in VP9610/9620
VP viewpoint 9610/VP9620 is the multi-point control unit of Huawei Video Conference system. By testing, there is a vulnerability of “Session ID not updating” in VP9610/9620. Vulnerability ID: HWNSIRT-2013-0318 Currently, official fixs are available...
Security Advisory-Overflow Vulnerabilities in SNMPv3
Simple Network Management Protocol version 3SNMPv3 is provided by Huawei for network and device management. While the SNMPv3 is enable on some Huawei products, attackers can crash the vulnerable equipment by sending malformed SNMPv3 messages, and make a denial of service DoS attack to vulnerable...