1030 matches found
Security Advisory - Out-of-bounds Read Vulnerability in Some Huawei Products
There is an out-of-bounds read vulnerability in some Huawei products. An unauthenticated, remote attacker has to control the peer device and craft the Signalling Connection Control Part SCCP messages to the target devices. Due to insufficient input validation of some values in the messages,...
Security Advisory - DoS Vulnerability in SMS Module of Some Huawei Smart Phones
There is a Denial of Service DoS vulnerability in the Short Message Service SMS module of some Huawei smart phones. An unauthenticated attacker may set up a pseudo base station, and send special malware text message to the phone, causing the mobile phone to fail to make calls and send and receive...
Security Advisory - FRP Bypass Vulnerability in Some Huawei Smart Phones
There is Factory Reset Protection FRP bypass vulnerability in some Huawei smart phones. An attacker gets some user's smart phone and performs some special operations in the guide function. The attacker may exploit the vulnerability to bypass FRP function and use the phone normally. Vulnerability...
Security Advisory - Side-Channel Vulnerability Variants 3a and 4
Intel publicly disclosed new variants of the side-channel central processing unit CPU hardware vulnerabilities known as Spectre and Meltdown. These variants known as 3A （CVE-2018-3640）and 4 （CVE-2018-3639, local attackers may exploit these vulnerabilities to cause information leak on the affected...
Security Advisory - Privilege Escalation Vulnerability in Some Huawei Smart Phones
Some Huawei smart phones has a privilege escalation vulnerability. An authenticated, local attacker can crafts malformed packets after tricking a user to install a malicious application and exploit this vulnerability when in the exception handling process. Successful exploitation may cause the...
Security Advisory - OpenSSL Vulnerability in Some Huawei Products
Constructed ASN.1 types with a recursive definition in some OpenSSL versions could eventually exceed the stack given malicious input with excessive recursion. Successful exploit of this vulnerability may result in a Denial of Service attack. Vulnerability ID: HWPSIRT-2018-03073 This vulnerability...
Security Advisory - Arbitrary Memory Free Vulnerability in GPU Driver of Some Huawei Smart Phones
There is an arbitrary memory free vulnerability in GPU driver of some Huawei smart phones due to insufficient parameters verification. An attacker can tricks a user into installing a malicious application on the smart phone, and send given parameter to driver to release special kernel memory...
Security Notice - Statement on the Disclosure of Malware VPNFilter by the Cisco Talos Team
Huawei has noticed that the Cisco Talos team reported malware VPNFilter on its blog website, indicating that VPNFilter was continuously infecting routers from multiple vendors and mentioning Huawei HG8245 product. Huawei promptly communicated with the Cisco Talos team. The Cisco Talos team has...
Security Advisory - CPU Vulnerabilities Meltdown and Spectre
Security researchers disclosed two groups of CPU vulnerabilities "Meltdown" and "Spectre". In some circumstances, a local attacker could exploit these vulnerabilities to read memory information belonging to other processes or other operating system kernel. Vulnerability ID:...
Security Advisory - Authentication Bypass Vulnerability in Some Huawei Servers
There is an authentication bypass vulnerability in some Huawei servers. A remote attacker with low privilege may bypass the authentication by some special operations. Due to insufficient authentication, an attacker may exploit the vulnerability to get some sensitive information and high-level...
Security Advisory - DoS Vulnerability in Some Huawei Smart Phones
Some Huawei smart phones have a denial of service DoS vulnerability due to the improper processing of malicious parameters. An attacker may trick a target user into installing a malicious APK and launch attacks using a pre-installed app with specific permissions. Successful exploit could allow th...
Security Advisory - Privilege Escalation Vulnerability in Some Huawei Servers
The iBMC Intelligent Baseboard Management Controller of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specially crafted login messages to the affected products. Due to improper authentication design, successful exploit enables low privileged users ...
Security Advisory - Stored XSS Vulnerability in eSpace Desktop
There is a stored cross-site scripting XSS vulnerability in eSpace Desktop. Due to the insufficient validation of the input, an authenticated, remote attacker could exploit this vulnerability to send abnormal messages to the system and perform a XSS attack. A successful exploit could cause the...
Security Advisory - Two JSON Injection Vulnerabilities in Some Huawei Servers
The iBMC Intelligent Baseboard Management Controller of some Huawei servers have two JSON injection vulnerabilities due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers t...
Security Advisory - Numeric Errors Vulnerability in Some Huawei Products
Some Huawei products have a numeric errors vulnerability. An unauthenticated, remote attacker may send specially crafted SCCP messages to the affected products. Due to the improper validation of the messages, it will cause numeric errors when handling the messages. Successful exploit will cause...
Security Advisory - Authentication Bypass Vulnerability in Some Huawei Servers
The iBMC Intelligent Baseboard Management Controller of some Huawei servers have an authentication bypass vulnerability. An unauthenticated, remote attacker may send some specially crafted messages to the affected products. Due to improper authentication design, successful exploit may cause some...
Security Advisory - Information Exposure Vulnerability in Some Smart Phones
There is an information exposure vulnerability in some Huawei smart phones. When the user's smart phone connects to the malicious device for charging, an unauthenticated attacker may activate some specific function by sending some specially crafted messages. Due to insufficient input validation o...
Security Advisory - Three JSON Injection Vulnerabilities in Huawei Some Products
There are three JSON injection vulnerabilities in Huawei some product. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management privilege of the system...
Security Advisory - Authentication Bypass Vulnerability in Huawei iBMC Products
There is an authentication bypass vulnerability in Huawei iBMC products. A remote attacker with low privilege may craft specific messages to upload authentication certificate to the affected products. Due to improper validation of the upload authority, successful exploit may cause privilege...
Security Advisory - Authentication Bypass Vulnerability in Some Smart Phones
There is an authentication bypass vulnerability in some Huawei smart phones. An attacker with high privilege obtains the smart phone and bypass the activation function by some specific operations. Vulnerability ID: HWPSIRT-2018-03001 This vulnerability has been assigned a Common Vulnerabilities a...
Security Advisory - Path Traversal Vulnerability in Some Huawei Home Gateway Products
There is a path traversal vulnerability on some Huawei home gateway products. Due to the lack of validation while these home gateway products install APK plugins, an attacker tricks a user into installing a malicious APK plugin, and plugin can overwrite arbitrary file of devices. Successful explo...
Security Advisory - DoS Vulnerability in Some Huawei MBB Products
Some Huawei MBB Mobile Broadband products have a Denial of Service DoS vulnerability. When an attacker accessing device sends special http request to device, the webserver process will try to apply too much memory which can cause the device to become unable to respond. An attacker can launch a Do...
Security Advisory - Remote Control Vulnerability in RCS Module of Some Huawei Smart Phones
There is a remote control vulnerability in RCS module of some Huawei smart phones. An attacker can trick a user to install a malicious application. When the application connects with RCS for the first time, it needs user to manually click to agree. In addition, the attacker needs to obtain the ke...
Security Advisory - Invalid Memory Access Vulnerability in Some Huawei Products
There is an invalid memory access vulnerability in some Huawei products. An unauthenticated attacker has to find a way to send malformed SCCP messages to the affected products. Due to insufficient input validation of some values in the messages, successful exploit may cause buffer error and some...
Security Advisory - Two Vulnerabilities in APPGallery of Huawei Smart Phones
There is a whitelist mechanism bypass vulnerability and an arbitrary Javascript running vulnerability in Huawei AppGallery. An attacker may set up a malicious network environment and trick user into accessing a malicious web page to bypass the whitelist mechanism, which make the malicious...
Security Advisory - Double Free Vulnerability in Some Huawei Smart Phones
The Mali Driver of some Huawei smart phones has a double free vulnerability. An attacker can trick a user to install a malicious application and exploit this vulnerability when in the exception handling process. Successful exploitation may cause system reboot. Vulnerability ID: HWPSIRT-2018-02020...
Security Advisory - Improper Resource Management Vulnerability in Some Huawei Products
There is an improper resource management vulnerability in some AR series products. Due to the improper implementation of ACL mechanism, a remote attacker may send TCP messages to the management interface of the affected device to exploit this vulnerability. Successful exploit could exhaust the...
Security Advisory - Buffer Overflow Vulnerability in Inputhub Driver of Huawei Smart Phone
The inputhub driver of some Huawei mobile phones has a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP and the APP may sends specific data to the inputhub driver to exploit this vulnerablity, successful exploit could...
Security Advisory - Buffer Error Vulnerability in Some Huawei Products
There are a buffer error vulnerability in Electronic Numbers to URI Mapping ENUM module some Huawei products. An unauthenticated, remote attacker has to control the peer device and send specially crafted ENUM packets to the affected products. Due to insufficient verification of some values in the...
Security Advisory - Authentication Bypass Vulnerability in Some Pre-installed Apps on Huawei Phones
There is an authentication bypass vulnerability in some pre-installed apps on Huawei mobile phones due to insufficient validation on invocation requests. An attacker may trick a user into installing a malicious app which can invoke the open interfaces of the vulnerable apps to install any apps...
Security Advisory - Invalid Memory Access Vulnerability in Some Huawei Products
There is an invalid memory access vulnerabilities in SCCPX module of some Huawei products. An unauthenticated, remote attacker may send specially crafted packets to the affected products. Due to insufficient validation of packets, successful exploit may cause some services abnormal. Vulnerability...
Security Advisory - Information Leak Vulnerability in the NFC Module of Some Huawei Mobile Phones
There is an information leak vulnerability in the Near Field Communication NFC module of some Huawei mobile phones due to insufficient validation on data transfer requests. When an affected mobile phone sends files to an attacker's mobile phone using the NFC function, the attacker can obtain...
Security Advisory - Improper Authorization Vulnerability on Huawei Switch Products
There is an improper authorization vulnerability on Huawei switch products. The system incorrectly performs an authorization check when a normal user attempts to access certain information which is supposed to be accessed only by authenticated user. Successful exploit could cause information...
Security Advisory - Weak Algorithm Vulnerability on Huawei Products
There is a weak encryption algorithm security vulnerability in the DBS3900 TDD LTE. DBS3900 TDD LTE supports SSL/TLS protocol negotiation using insecure encryption algorithms. If an insecure encryption algorithm is negotiated in the communication, an unauthenticated remote attacker can exploit th...
Security Advisory - Integer overflow Vulnerability in Bdat Driver of Huawei Smart Phone
The Bdat driver of some Huawei smart phones has integer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP and execute it as a specific privilege; the APP can send a specific parameter to the driver of the smart phone, causing...
Security Advisory - Information Disclosure Vulnerability on Huawei Smartphones
There is an information disclosure vulnerability on Huawei smartphones. The software does not properly protect certain resource which can be accessed by multithreading. An attacker tricks the user who has root privilege to install a crafted application, successful exploit could result in kernel...
Security Advisory - Out-of-bounds Read Vulnerability in Huawei Smartphone Products
There is an out-of-bounds read vulnerability in Huawei Smartphone products. Due to the lack string terminator of string, an attacker tricks a user into installing a malicious application, and the application can exploit the vulnerability and make attacker to read out of bounds and possibly cause...
Security Advisory - Memory Double Free Vulnerability on Huawei Smartphones
There is a memory double free vulnerability on Huawei smartphones. The system does not manage the memory properly, that frees on the same memory address twice. An attacker tricks the user who has root privilege to install a crafted application, successful exploit could result in malicious code...
Security Advisory - Array Out-of-bounds Read Vulnerability in Huawei Smartphone Products
There is an array out-of-bounds read vulnerability in Huawei Smartphone products. Due to the lack verification of array, an attacker tricks a user into installing a malicious application, and the application can exploit the vulnerability and make attacker to read out of bounds of array and possib...
Security Advisory - Information Disclosure Vulnerability on Honor Smart Scale Application
There is an information disclosure vulnerability on Honor Smart Scale application. The application does not sufficiently restrict the resource which can be accessed by certain protocol. An attacker could trick the user to click a malicious link, successful exploit could cause information...
Security Advisory - Buffer Overflow Vulnerability in eNSP Software
There is a buffer overflow vulnerability in eNSP software. Due to the improper validation of specific command line parameter, a local attacker could exploit this vulnerability to cause the software process abnormal. Vulnerability ID: HWPSIRT-2017-12012 This vulnerability has been assigned a Commo...
Security Advisory - Authentication Bypass Vulnerability in Some Huawei Smart Phones
The soundtrigger module of some Huawei smart phones has an authentication bypass vulnerability due to the improper design of the module. An attacker tricks a user into installing a malicious application, and the application can exploit the vulnerability to replace related authentication...
Security Advisory - Permission Control Vulnerability in Huawei Video Application
There is a permission control vulnerability in Huawei video applications. Due to improper verification of specific infterface, an attacker who is on the same network with the user can obtain some information through a man-in-the-middle attack. Vulnerability ID: HWPSIRT-2018-02026 This vulnerabili...
Security Advisory - Information Leak Vulnerability in Some Huawei Products
There is an information leak vulnerability in the NFC Near Field Communication module of some Huawei mobile phones. The attacker has to trick a user to do some specific operations and then craft the NFC message to exploit this vulnerability. Successful exploit will cause some information leak...
Security Advisory - Buffer Error Vulnerability in Some Huawei Products
There is a buffer overflow vulnerability in the SCCP Signalling Connection Control Part module of some Huawei products. An attacker has to find a way to send malformed packets to the affected products repeatedly. Due to insufficient input validation, successful exploit may cause some service...
Security Advisory - Remote Code Execution Vulnerability in Jackson JSON library of Apache Struts2
Apache Struts2 released a remote code execution vulnerability in S2-055 on the official website. An attacker is possible to perform a Remote Code Execution RCE attack with a malicious JSON packet. Vulnerability ID: HWPSIRT-2017-12002 This vulnerability has been assigned a Common Vulnerabilities a...
Security Advisory - Out-of-Bounds Read Vulnerability in Some Huawei Products
There is an out-of-bounds read vulnerability in the SFTP module of some Huawei products. A remote, authenticated attacker could exploit this vulnerability by sending specially crafted messages to a target device. Successful exploit may cause some information leak. Vulnerability ID:...
Security Advisory - Out-Of-Bounds Write Vulnerability on Several Huawei Products
There is an out-of-bounds write vulnerability on several Huawei products. When a user executes a query command after the device received an abnormal OSPF message, the software writes data past the end of the intended buffer due to the insufficient verification of the input data. An unauthenticate...
Security Advisory - Six Vulnerabilities in Some Huawei Products
There are two out-of-bounds read vulnerability in some Huawei products. Due to insufficient input validation, an authenticated, remote attacker could send malformed SOAP packets to the target device. Successful exploit could make the device access invalid memory and might reset a process...
Security Advisory - Two Vulnerabilities in the SIP Module of Some Huawei Products
There is an out-of-bound read vulnerability in some Huawei products. A remote attacker send specially crafted Session Initiation Protocol SIP messages to the affected products. Due to insufficient input validation, successful exploit will cause some services abnormal. Vulnerability ID:...