1006 matches found
Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones
There is Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker can login the configuration flow by some secret code and can perform some operations to update the...
Security Advisory - Information Leak Vulnerability in Huawei APP
Some Huawei APPs have an information leak vulnerability. When an iPhone with these APPs installed access the Wi-Fi hotpot built by attacker, the attacker can collect the information of iPhone mode and firmware version. Vulnerability ID: HWPSIRT-2017-02025 This vulnerability has been assigned a CV...
Security Advisory - Buffer Overflow Vulnerability in Some Huawei Products
There is a buffer overflow vulnerability in Connectivity Fault Management CFM function of some Huawei Products. When CFM is enabled and Maintenance Association End Point MEP is configured on the affected device, an adjacent attacker could exploit this vulnerability by sending crafted packets to t...
Security Advisory - Multiple Security Vulnerabilities in Driver of Huawei Smart Phones
There are multiple security vulnerabilities in driver of some Huawei smart phones. There are two interface access control vulnerabilities in Graphics driver. An attacker may trick a user into installing a malicious application and application can exploit the vulnerability to crash the system or...
Security Advisory-VRP SSH Denial of Service Vulnerability
The SSH of the VRP has an input verification issue. Remote attackers can send a special SSH packet to the device to cause a denial of service Vulnerability ID: HWPSIRT-2014-0701. This Vulnerability has been assigned Common Vulnerabilities and Exposures CVE ID: CVE-2014-8572...
Security Advisory - Incorrect Privilege Assignment Vulnerability in Huawei Whole-Home Intelligence Software
A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnerability could allow attackers to access restricted functions.Vulnerability ID:HWPSIRT-2022-52968 This vulnerability has been assigned a CVE ID: CVE-2022-48...
Security Advisory - Traffic Hijacking Vulnerability in Huawei Routers
There is a traffic hijacking vulnerability in Huawei routers. Successful exploitation of this vulnerability can cause packets to be hijacked by attackers. Vulnerability ID: HWPSIRT-2021-21766 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2021-46835. For...
Security Advisory - Improper Authentication Management Vulnerability in some Huawei Products
There is an improper authentication vulnerability in some huawei products.Successful exploitation of this vulnerability may lead to a control of the victim device. Vulnerability ID: HWPSIRT-2021-30580 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID:...
Security Advisory - FasterXML Jackson-databind Injection Vulnerability in Huawei Products
It was found that jackson-databind, a Java library used to parse JSON and other data formats, could deserialize data without proper validation, allowing a maliciously client to perform remote code execution on a service with the required characteristics.Vulnerability ID: HWPSIRT-2020-02149 This...
Security Advisory - Information Disclosure Vulnerability in Several Smartphones
There is an information disclosure vulnerability in certain Huawei smartphones. The software does not properly handle certain information of application locked by applock in a rare condition, successful exploit could cause information disclosure. Vulnerability ID: HWPSIRT-2018-08142 This...
Security Advisory - Improper Authorization Vulnerability on iBMC
There is an improper authorization vulnerability on iBMC. The software incorrectly performs an authorization check when a normal user attempts to access certain information which is supposed to be accessed only by admin user. Successful exploit could cause information disclosure. Vulnerability ID...
Security Advisory - Multiple Input Validation Vulnerabilities in CIDAM Protocol on Huawei Products
The CIDAM Protocol on Huawei Products has multiple input validation vulnerabilities due to insufficient validation of specific messages when the protocol is implemented. An authenticated remote attacker could send a malicious message to a target system. Successful exploit could allow the attacker...
Security Advisory - Denial of Service Vulnerability on Several Huawei Products
There is a denial of service vulnerability on several products. The software does not correctly calculate the rest size in a buffer when handling SSL connections. A remote unauthenticated attacker could send a lot of crafted SSL messages to the device, successful exploit could cause no space in t...
Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones
There is Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker can login the Swype and can perform some operations to update the Google account. As a result, the FRP...
Security Advisory - Two Vulnerabilities in Smart Phones
Some Huawei smart phones have an unlock code verification bypassing vulnerability. An attacker with the root privilege of a mobile can exploit this vulnerability to bypass the unlock code verification and unlock the mobile phone bootloader. Vulnerability ID: HWPSIRT-2017-04121 This vulnerability...
Security Advisory - Privilege Escalation Vulnerability in Huawei Multiple Smart Phones
There is a privilege escalation vulnerability in Android kernel due to the lack of a parameters check. An attacker may trick a user into installing a malicious application, and the application can modify the data of kernel to crash the system or escalate user privilege. Vulnerability ID:...
Security Advisory - Memory Leak Vulnerability in Huawei Switches
When serving as an HTTPS or SFTP server, the Huawei switch stores a user's SSL session information in the memory even after the user logs out. If the memory occupied by the SSL session information exceeds the allocated amount, memory leak occurs, causing the device to restart. Vulnerability ID:...
Security Advisory - Insufficient Input Verification Vulnerability In Huawei Product
There is an insufficient input verification vulnerability in Huawei product. Successful exploitation of this vulnerability may lead to service abnormal. Vulnerability ID: HWPSIRT-2022-76192 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2022-32144. For...
Security Advisory - Cross-Site Scripting(XSS) Vulnerability in Huawei WS318n Product
There is a Cross-Site ScriptingXSS vulnerability in HUAWEI WS318n product when processing network settings. Due to insufficient validation of user input, a local authenticated attacker could exploit this vulnerability by injecting special characters. Successful exploit could cause certain...
Security Advisory - Improper Permission Assignment Vulnerability in Huawei ManageOne Product
There is an improper permission assignment vulnerability in Huawei ManageOne product. Due to improper security hardening, the process can run with a higher privilege. Successful exploit could allow certain user to do certain operations with improper permission. Vulnerability ID: HWPSIRT-2020-8163...
Security Advisory - Out-of-bounds Read Vulnerability in Some Huawei Smartphones
There is an out-of-bounds read and write vulnerability in smartphone products. An attacker with specific permissions crafts malformed packet with specific parameter and sends the packet to the affected products. Due to insufficient validation of packet, which may be exploited to cause the...
Security Advisory - Insecure Encryption Algorithm Vulnerability in Some Huawei Products
Some Huawei products have an insecure encryption algorithm vulnerability. Attackers with high permissions can exploit this vulnerability to cause information leak. Vulnerability ID: HWPSIRT-2020-05067 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2020-912...
Security Advisory - Out-of-Bounds Read Vulnerability in Some Huawei Smart Phone
There is an out-of-bounds read vulnerability in XFRM module of some Huawei smart phone. An authenticated, local attacker may perform a specific operation to exploit this vulnerability. Due to insufficient validation of the parameters, which may be exploited to cause information leak. Vulnerabilit...
Security Advisory - DoS Vulnerability in Some Huawei Smart Phones
There is a denial of service DoS vulnerability in some Huawei smart phones. The attacker can enter a large amount of text on the phone. Due to insufficient verification of the parameter, successful exploitation can impact the service. Vulnerability ID: HWPSIRT-2019-09107 This vulnerability has be...
Security Advisory - Out-of-bounds Write Vulnerability in Some Huawei Products
There is an out-of-bounds write vulnerability in some products. An unauthenticated attacker crafts malformed packets with specific parameter and sends the packets to the affected products. Due to insufficient validation of packets, which may be exploited to cause the process reboot. Vulnerability...
Security Advisory - Path Traversal Vulnerability in Several Smartphones
There is a path traversal vulnerability in several smartphones. The system does not sufficiently validate certain pathname from certain process, successful exploit could allow the attacker write files to a crafted path. Vulnerability ID: HWPSIRT-2019-10116 This vulnerability has been assigned a...
Security Advisory - Improper Input Verification Vulnerability in Huawei Smartphone
There is an improper input verification vulnerability in Huawei smartphone. An attribution in a module is not set correctly and some verification is lacked. Attackers with local access can exploit this vulnerability by injecting malicious fragment. This may lead to user information leak...
Security Advisory - Insufficient Input Verification of Some Huawei products
Some Huawei products have a vulnerability of insufficient input verification. An attacker with limited privilege can exploit this vulnerability to access a specific directory. Successful exploitation of this vulnerability may lead to information leakage. Vulnerability ID: HWPSIRT-2020-05141 This...
Security Advisory - Insufficient Integrity Validation Vulnerability in Several Products
There is an insufficient integrity validation vulnerability in several products. The device does not sufficiently validate the integrity of certain file in certain loading processes, successful exploit could allow the attacker to load a crafted file to the device through USB. Vulnerability ID:...
Security Advisory - Information Leak Vulnerability in Some Huawei Products
Some Huawei mobile phones have an information leak vulnerability. Due to improper function error records of some module, an attacker with the access permission may exploit the vulnerability to obtain some information. Vulnerability ID: HWPSIRT-2019-04053 This vulnerability has been assigned a...
Security Advisory - Memory Leak Vulnerability on Several Products
There is a memory leak vulnerability on several products. The software does not release allocated memory properly when processing Protal questionnaire. A remote attacker could send a lot questionnaires to the device, successful exploit could cause the device to reboot since running out of memory...
Security Advisory - Remote Control Vulnerability in RCS Module of Some Huawei Smart Phones
There is a remote control vulnerability in RCS module of some Huawei smart phones. An attacker can trick a user to install a malicious application. When the application connects with RCS for the first time, it needs user to manually click to agree. In addition, the attacker needs to obtain the ke...
Security Advisory - Two Vulnerabilities in APPGallery of Huawei Smart Phones
There is a whitelist mechanism bypass vulnerability and an arbitrary Javascript running vulnerability in Huawei AppGallery. An attacker may set up a malicious network environment and trick user into accessing a malicious web page to bypass the whitelist mechanism, which make the malicious...
Security Advisory - Out-Of-Bounds Write Vulnerability on Several Huawei Products
There is an out-of-bounds write vulnerability on several Huawei products. When a user executes a query command after the device received an abnormal OSPF message, the software writes data past the end of the intended buffer due to the insufficient verification of the input data. An unauthenticate...
Security Advisory - Fingerprint Unlocking Vulnerability on Smartphones
There is a fingerprint unlocking vulnerability on smartphones. If there are crackles on the fingerprint collector cover, the software would consider and learn the crackles as fingerprint feature when user press his finger on the cover to unlock the phone. So after lots of normal fingerprint...
Security Advisory - Denial of Service Vulnerability on Several Products
There is a denial of service vulnerability on several products. The software decodes X.509 certificate in an improper way. A remote unauthenticated attacker could send a crafted X.509 certificate to the device. Successful exploit could result in a denial of service on the device. Vulnerability ID...
Security Advisory - Multiple Vulnerabilities in MTK Platform
There are multiple vulnerabilities in MTK platform used in Huawei smart phones. There is a out-of-bound read vulnerability in MTK platform used in Huawei smart phones. An attacker tricks a user into installing a malicious application on the smart phone, and send given parameter and cause to memor...
Security Advisory - Multiple Buffer Overflow Vulnerabilities in Driver of Huawei Smart Phone
The driver of some Huawei smart phones have six buffer overflow vulnerabilities due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege of the Android system, the APP can send a specific parameter to the driver of the smart...
Security Advisory - Input Validation Vulnerability in Huawei VRP Platform
There is an input validation vulnerability in some Huawei devices using VRP. Due to the lack of input validation, an attacker may craft a malformed packet and send it to the device using VRP, causing the device to display additional memory data and possibly leading to sensitive information leakag...
Security Advisory - Unquoted Service Path Vulnerability in Huawei UTPS Software
Huawei Unified Terminal PC suite UTPS, also known as Mobile Partner, runs on the PC side to manage data cards. It provides data card setting, dial-up setting, message sending and receiving, and contacts management functions. Huawei UTPS has an unquoted service path vulnerability which can lead to...
Security Advisory - Path Traversal Vulnerability in Huawei Home Gateway Products
There is a path traversal vulnerability on several Huawei home gateway products. The products do not properly validate HTTP requests received by a specific port. An remote attacker may access the local files on the device without authentication by crafting an HTTP request and sending it to the...
Security Advisory - Memory Overflow Vulnerability in the Huawei Smartphone
There has a memory overflow vulnerability in Some Huawei mobile phone products. An attacker may exploit this vulnerability to gain the root access over the mobile phones. Then the attacker can further modify memory data and obtain sensitive information. Vulnerability ID: HWPSIRT-2015-10046 This...
Security Advisory-Information Leakage Vulnerability in Huawei P7 Smartphone
MeWidget is a plug-in of Huawei Emotion UI. The MeWidget module on Huawei smartphone P7 has a vulnerability that could lead to the disclosure of contact information. Attackers can obtain the name and URI information of mobile phone users through the malware installed on the smartphones...
Security Advisory-Memory Leak Vulnerability on USG products
The HUAWEI USG9560/9520/9580 is a high-end 10-Gigabit Firewall. The USG9560/9520/9580 applies to Internet backbone networks, IP dedicated backbone networks, IP metropolitan area networks MANs, Internet data center IDC egress. This security gateway provides multiple powerful and all-round security...
Security Advisory-Information Leakage Vulnerability via MPLS Ping in VRP Platform
VRP Versatile Routing Platform has been developed by Huawei to provide improved IP routing services. The VRP has been widely applied to network devices, including high-end and low-end switches and routers, wireless and transmission devices. Information leakage vulnerability exists in several...
Security Advisory- Y.1731 Vulnerability on Some Huawei Switches
Y.1731 is an ITU-T recommendation for OAM features on Ethernet-based networks. Y.1731 provides connectivity detection, diagnosis, and performance monitoring for VLAN/VSI services on MANs. Some Huawei switches support Y.1731 and therefore, has the Y.1731 vulnerability in processing special packets...
Security Advisory - Denial of Service Vulnerability in some Huawei Products
There is a denial of service vulnerability in some Huawei products. Successful exploitation could cause denial of service. Vulnerability ID: HWPSIRT-2022-27465 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2022-29798. For products that have released...
Security Advisory - Command Injection Vulnerability in Huawei FusionCompute Product
There is a command injection vulnerability in CMA service module of FusionCompute product when processing the default certificate file. The software constructs part of a command using external special input from users, but the software does not sufficiently validate the user input. Successful...
Security Advisory - Denial of Service Vulnerability in Some Huawei Products
There is a denial of service vulnerability in some Huawei products. An attacker could exploit this vulnerability by sending specific message to a targeted device. Due to insufficient input validation, successful exploit can cause the service abnormal. Vulnerability ID: HWPSIRT-2020-24699 This...
Security Advisory - Weak Secure Algorithm Vulnerability in Huawei Product
There is a weak secure algorithm vulnerability in Huawei products. A weak secure algorithm is used in a module. Attackers can exploit this vulnerability by capturing and analyzing the messages between devices to obtain information. This can lead to information leak. Vulnerability ID:...