Security Advisory - DoS Vulnerability in Multiple Huawei Products

There is a DoS vulnerability in some Huawei products. Since the device does not validate the parameters in a certain command, an attacker with certain permissions could log in and deliver the command containing a malicious parameter to make the device restart. Vulnerability ID: HWPSIRT-2016-06064...

Security Advisory - Memory Leak Vulnerability in Several Huawei Products

There is a vulnerability in several Huawei devices: USG series, NGFW module, IPS module, NIP series and AntiDDoS8000. A memory leak vulnerability exists in these products. In hot standby networking where two devices are not directly connected, an attacker can craft a malformed packet, which...

Security Advisory - Command Injection Vulnerability in OpsMonitor

There is a command injection vulnerability in OpsMonitor service. Due to lack of validation of user input, an authenticated user may inject malicious command into the affected products, causing command execution with root privilege in OpsMonitor service. Vulnerability ID: HWPSIRT-2017-10062 Huawe...

Security Advisory - Sensitive Information Disclosure Vulnerability on FusionSphere OpenStack

There is a sensitive information disclosure vulnerability on FusionSphere OpenStack. The software stores some sensitive information with insufficient access control. An unauthenticated remote attacker could get sensitive information by accessing certain ports. Vulnerability ID: HWPSIRT-2017-06223...

Security Advisory - Input Validation Vulnerability in Wi-Fi Driver of Huawei Smart Phones

There is an input validation vulnerability in the Wi-Fi Driver of some Huawei smart phones. An attacker can tricks a user into installing a malicious application on the smart phone, and send given parameter to smart phone to crash the system or escalate privilege. Vulnerability ID:...

Security Advisory - A Security Vulnerability of Using Insecure Random Numbers to Generate Self-signed Certificates in Huawei Products

Some Huawei products automatically generate self-signed certificates upon the first use. The random numbers used to generate these certificates are not random enough. Different devices' certificates may use the same random number consequently, which contains the risk of an attacker compromising t...