1006 matches found
Security Advisory - Buffer Overflow Vulnerability in Some Huawei Mobile Phones
Some Huawei products have a buffer overflow vulnerability. After obtaining the root permission, an attacker can exploit the vulnerability to cause buffer overflow. Vulnerability ID: HWPSIRT-2020-43452 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID:...
Security Advisory - Local Privilege Escalation Vulnerability in Huawei FusionCompute Product
There is a local privilege escalation vulnerability in Huawei FusionCompute product. A local, authenticated attacker could perform specific operations to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege and compromise the service. Vulnerabili...
Security Advisory - Improper Authentication Vulnerability in Some Huawei Smartphones
There is an improper authentication vulnerability in some Huawei smartphones. Due to the identity of the message sender is not properly verified, an attacker can exploit this vulnerability through man-in-the-middle attack to induce user to access malicious URL. Vulnerability ID: HWPSIRT-2019-1213...
Security Advisory - Authentication Bypass Vulnerability in Some Huawei Smart Phones
The soundtrigger module of some Huawei smart phones has an authentication bypass vulnerability due to the improper design of the module. An attacker tricks a user into installing a malicious application, and the application can exploit the vulnerability to replace related authentication...
Security Advisory - Information Leak Vulnerability in Huawei FusionSphere OpenStack
Huawei FusionSphere OpenStack has an information leak vulnerability due to the use of a low version transmission protocol by default. An attacker could intercept packets transferred by a target device. Successful exploit could cause an information leak. Vulnerability ID: HWPSIRT-2017-07112 This...
Security Advisory - Two Vulnerabilities in Some Huawei CPE Devices
The outdoor unit of some Customer Premise Equipment CPE has a no authentication vulnerability on a certain port. After accessing the network between the indoor and outdoor units of the CPE, an attacker can deliver commands to the specific port of the outdoor unit and execute them without...
Security Advisory - App Lock Bypass Vulnerability in Huawei Mobile Phones
App Lock is a function provided by the Phone Manager app to prevent unauthorized use of apps on mobile phones. Some Huawei mobile phones have an App Lock bypass vulnerability. An attacker could perform specific operations to bypass the App Lock to use apps on a target mobile phone temporarily...
Security Advisory - Bluetooth Unlock Bypassing Vulnerability in Some Huawei Mobile Phones
Some Huawei mobile phones have a Bluetooth unlock bypassing vulnerability due to the lack of validation on Bluetooth devices. If a user has enabled the smart unlock function, an attacker can impersonate the user's Bluetooth device to unlock the user's mobile phone screen. Vulnerability ID:...
Security Advisory - MITM Vulnerability in Huawei Vmall APP
The upgrade package of Huawei Vmall APP is transferred through HTTP. A man in the middle MITM can tamper with the upgrade package of Huawei Vmall APP, and to implant the malicious applications. Vulnerability ID: HWPSIRT-2016-11068 This vulnerability has been assigned a Common Vulnerabilities and...
Security Advisory - Two Security Vulnerabilities in Huawei EMUI
Huawei EMUI3.1 has two vulnerabilities. The Keyguard application in Huawei EMUI3.1 has a privilege elevation vulnerability due to insufficient validation on specific parameters. An attacker may trick a user into installing a malicious application. Successful exploit could allow the attacker to...
Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones
Factory Reset Protection FRP is a security method that was designed to make sure someone can't just wipe and factory reset the phone if user lost it or it was stolen. The FRP in some Huawei smart phones can be bypass. An attacker can bypass the FRP by special steps and wipe and factory reset the...
Security Advisory - Two Information Leak Vulnerabilities in ION Memory Management Module of Huawei Smart Phone
Two information leak vulnerabilities exist in the ION memory management module of some Huawei mobile phones due to the lack of initialization during memory allocation. Vulnerability ID: HWPSIRT-2016-09032 and HWPSIRT-2016-09033 These two vulnerabilities have been assigned CVE ID: CVE-2016-8757 an...
Security Advisory - Apache Struts2 Remote Code Execution Vulnerability in Huawei Products
Apache Struts2 released a remote code execution vulnerability in S2-032 on the official website,when Dynamic Method Invocation DMI is enabled, an exploit could allow the attacker to cause remote code execution.Vulnerability ID: HWPSIRT-2016-04052 This vulnerability has been assigned a Common...
Security Advisory - System Command Injection Vulnerability in a Huawei Printer Product
A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution.Vulnerability ID:HWPSIRT-2022-90270 This vulnerability has been assigned a CVEID:CVE-2022-48472...
Security Advisory - Insufficient Input Validation Vulnerability in Some Huawei Smartphones
Some Huawei Smartphones has an insufficient input validation vulnerability due to the lack of parameter validation. An attacker may trick a user into installing a malicious APP. The app can modify specific parameters, causing the system to crash. Vulnerability ID: HWPSIRT-2020-05121 This...
Security Advisory - Arbitrary Memory Write Vulnerability in Huawei Smart Phone
There is an arbitrary memory write vulnerability in Huawei smart phone when processing file parsing. Due to insufficient validation of the input files, successful exploit could cause certain service abnormal. Vulnerability ID: HWPSIRT-2020-04031 This vulnerability has been assigned a Common...
Security Advisory - Buffer Overflow Vulnerability in Some Huawei Products
Some Huawei products have a buffer overflow vulnerability. An attacker induces users to install malicious applications and sends specially constructed packets to affected devices after obtaining the root permission. Successful exploit may cause code execution. Vulnerability ID: HWPSIRT-2020-04125...
Security Advisory - Denial of Service Vulnerability in Several Smartphones
There is a denial of service vulnerability in several smartphones. Certain system configuration can be modified because of improper authorization. The attacker should trick the user installing and executing a malicious application, successful exploit could cause a denial of service condition of...
Security Advisory - Improper Authorization Vulnerability in Huawei Product
There is an improper authorization vulnerability in Huawei FusionComput. A module does not verify some input correctly and authorizes files with incorrect access. Attackers can exploit this vulnerability to launch privilege escalation attack. This can compromise normal service. Vulnerability ID:...
Security Advisory - Two Vulnerabilities in Huawei PCManager Product
There is a privilege escalation vulnerability in Huawei PCManager product. Successful exploitation may cause the attacker to obtain a higher privilege. Vulnerability ID: HWPSIRT-2018-11141 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2019-5241. There is ...
Security Advisory - Authentication Bypass Vulnerability in Some Huawei Smart Phones
Some Huawei smartphones have an authentication bypass vulnerability. When the attacker obtains the user's smartphone, the vulnerability can be used to replace the start-up program so that the attacker can obtain the information in the smartphone and achieve the purpose of controlling the...
Security Advisory - Three Vulnerabilities in SCCPX Module of Some Huawei Products
There is an out-of-bounds read vulnerability in SCCPX module of some Huawei products. An unauthenticated, remote attacker crafts malformed packets with specific parameter to the affected products. Due to insufficient validation of packets, successful exploitation may impact availability of produc...
Security Advisory - Buffer Overflow Vulnerability in the NFC Module of Some Huawei Mobile Phones
The Near Field Communication NFC module of some Huawei mobile phones has a buffer overflow vulnerability due to the lack of input validation. An attacker may use an NFC card reader or another device to inject malicious data into a target mobile phone. Successful exploit could lead to system resta...
Security Advisory - Multiple Vulnerabilities in XML Parser of Some Huawei Products
There are multiple buffer overflow vulnerabilities in some Huawei products due to the lack of validation. An authenticated local attacker can craft specific XML files to the affected products and parse this file, which result in DoS attacks or remote code execution on the device. Vulnerability ID...
Security Advisory - A CGI application vulnerability in Some Huawei Products
Some open source software used by Huawei does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an...
Security Advisory - Information Leak Vulnerability in Huawei FusionSphere Openstack
There is an information leak vulnerability in Huawei FusionSphere Openstack. Due to an incorrect configuration item, the information transmitted by a transmission channel is not encrypted. An attacker accessing the internal network may obtain sensitive information transmitted. Vulnerability ID:...
Security Advisory - Multiple Vulnerabilities in FusionSphere OpenStack
There is a privilege escalation vulnerability in Huawei FusionSphere OpenStack. Due to improper privilege restrictions, an attacker with high privilege may obtain the other users' certificates. Successful exploit may cause privilege escalation. Vulnerability ID: HWPSIRT-2017-07053 This...
Security Advisory - Authentication Bypass Vulnerability in the 'Find Phone' Function of some Huawei Smart Phones
The 'Find Phone' function of some Huawei smart phones has an authentication bypass vulnerability. An unauthenticated attacker may wipe and factory reset the phone by special steps. Due to missing authentication of the 'Find Phone' function, an attacker may exploit the vulnerability to bypass the...
Security Advisory - EFM Flapping Vulnerability in Huawei Products
Some Huawei VRP-based products have an Ethernet in the First Mile EFM flapping vulnerability due to the lack of type-length-value TLV consistency check. An attacker may craft malformed packets and send them to a device to cause EFM flapping. Vulnerability ID: HWPSIRT-2016-09025 This vulnerability...
Security Advisory - Privilege Escalation Vulnerability in Some Huawei Storage Products
Some Huawei storage products have a privilege escalation vulnerability due to the lack of input validation. Attackers with administrator privilege could inject command into specific command’s parameters, and run this injected command with root privilege. Vulnerability ID: HWPSIRT-2016-05004 This...
Security Advisory - Multiple Security Vulnerabilities in Huawei Smart Phone Products
The TrustZone driver of some Huawei smart phone products has an input validation vulnerability. An attacker may trick the target user into installing a malicious APP which could exploit this vulnerability to pass specific parameters to the TrustZone driver. Successful exploit could cause the syst...
Security Advisory - Hardcoded SSH Key Vulnerability in Some Huawei Storage Products
Some Huawei storage products have a hardcoded SSH key vulnerability. Different nodes of the devices use SSH to encrypt communication data and authenticate each other based on public and private keys. Since the SSH public and private keys are hardcoded, an attacker may obtain the keys and log in t...
Security Advisory - Buffer Overflow Vulnerability in Huawei USG Products
The Authentication, Authorization and Accounting AAA module in the USG products has a buffer overflow vulnerability. A remote attacker can send crafted Enterprise Application Platform EAP packets to the USG products through a Remote Authentication Dial In User Service RADIUS server which has...
Security Advisory - Input Validation Vulnerabilities in Camera Driver of Huawei Smart Phones
There are five input validation vulnerabilities in the Camera driver of some Huawei smart phones. An attacker may trick a user into installing a malicious application, and the application can send given parameter to Camera driver to crash the system or escalate user privilege. Vulnerability ID:...
Security Advisory - ICMPv6 DoS Vulnerability in Huawei Switches
Multiple Huawei switches improperly release memory for ICMPv6 packets of a specific type. After the switch receives a specially crafted ICMPv6 packet, memory leak occurs, causing the switch to restart if the allocated memory is exhausted. Vulnerability ID: HWPSIRT-2015-11034 This vulnerability ha...
Security Advisory - Bar Mitzvah Attack Vulnerability in Huawei Products
A security vulnerability exists in Rivest Cipher 4 RC4 used by TLS and SSL protocols. RC4 cannot provide sufficient data protection. After listening to an SSL or TLS connection, an attacker can obtain plaintext data by brute force cracking. This vulnerability is also called Bar Mitzvah...
Security Advisory - Improper Authorization Vulnerability in a Huawei Children's Watch
Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file. Vulnerability ID:HWPSIRT-2022-62345 This vulnerability has been assigned a CVE ID: CVE-2022-45874...
Security Advisory - Out-of-bounds Read and Write Vulnerability in Some Huawei Headset Products
There is an out-of-bounds read and write vulnerability in some headset products. An unauthenticated attacker gets the device physically and crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message, which may be...
Security Advisory - Denial of Service Vulnerability in Some Products
There is a denial of service vulnerability in some huawei products. In specific scenarios, due to the improper handling of the packets, an attacker may craft the specific packet. Successful exploit may cause some services abnormal. Vulnerability ID: HWPSIRT-2020-70186 This vulnerability has been...
Security Advisory - Denial of Service Vulnerability in Huawei Product
There is a denial of service vulnerability in Huawei product. The affected product cannot deal with some messages because of module design weakness . Attackers can exploit this vulnerability by sending a large amount of specific messages to cause denial of service. This can compromise normal...
Security Advisory - Buffer Overflow Vulnerability in the Bluetooth Module of Some Huawei Mobile Phones
There is a buffer overflow vulnerability in the Bluetooth module of some Huawei mobile phones. Due to insufficient input validation, an unauthenticated attacker may craft Bluetooth messages after successful paring, causing buffer overflow. Successful exploit may cause code execution. Vulnerabilit...
Security Advisory - Out-of-Bounds Read and Write Vulnerability in Huawei Smartphone
There is an out-of-bounds read and write vulnerability in Huawei smartphone. Some functions do not verify inputs sufficiently. Attackers can exploit this vulnerability by sending specific request. This could compromise normal service of the affected device. Vulnerability ID: HWPSIRT-2020-03107 Th...
Security Advisory - Protection Mechanism Failure Vulnerability in Some Huawei Products
There is a protection mechanism failure vulnerability in some Huawei products. The product incorrectly uses a protection mechanism. An attacker has to find a way to exploit the vulnerability to conduct directed attacks against the affected product. Vulnerability ID: HWPSIRT-2020-05077 This...
Security Advisory - Improper Authentication Vulnerability in Some Huawei Smartphones
There is an improper authentication vulnerability in some Huawei smartphones. The vulnerability is due to that when an user wants to do certain operation, the software insufficiently validate the user's identity. Attackers need to physically access the smartphone to exploit this vulnerability...
Security Advisory - Information Leak Vulnerability in Some Huawei Smartphones
There is an information leak vulnerability in some Huawei smartphones. An attacker may do some specific configuration in the smartphone and trick a user into inputting some sensitive information. Due to improper design, successful exploit may cause some information leak. Vulnerability ID:...
Security Advisory - Authentication Bypass Vulnerability in Some Huawei Mobile Phones
There is an authentication bypass vulnerability in some Huawei mobile phones. An attacker could trick the user to connect to a malicious device. In the debug mode, the malicious software in the device may exploit the vulnerability to bypass some specific function. Successful exploit may cause som...
Security Advisory - Two Remote Code Execution Vulnerabilities in Microsoft Windows
Microsoft released a security advisory to disclose a remote code execution vulnerability in Microsoft Server Message Block 1.0 SMBv1. A remote attacker could send a specially crafted packet to a targeted SMBv1 server. The attacker could exploit the vulnerability to gain the ability to execute cod...
Security Advisory - Information Leak Vulnerability in Some Huawei Smart Phones
There is a information leak vulnerability in the date service proxy implementation of some Huawei smart phones. An attacker may trick a user into installing a malicious application and application can exploit the vulnerability to get kernel date, which may cause sensitive information leak...
Security Advisory - DoS Vulnerability in XML Parser of Some Huawei Products
XML parser has a DoS vulnerability in some Huawei products. Due to not check the specially XML file enough, an authenticated local attacker may craft specific XML files to the affected products and parse this file, which cause to null pointer accessing and result in DoS attacks. Vulnerability ID:...
Security Advisory - Multiple Vulnerabilities in Intel Management Engine Firmware
There are multiple vulnerabilities in Intel Management Engine ME firmware. Some Huawei devices are affected for using related Intel products. Multiple buffer overflows in kernel in Intel Manageability Engine Firmware 11.0/11.5/11.6/11.7/11.10/11.20 allow attacker with local access to the system t...