1030 matches found
Security Advisory - Input Validation Vulnerability in Wi-Fi Driver of Huawei Smart Phones
There is an input validation vulnerability in the Wi-Fi Driver of some Huawei smart phones. An attacker can tricks a user into installing a malicious application on the smart phone, and send given parameter to smart phone to crash the system or escalate privilege. Vulnerability ID:...
Security Advisory - Stack Overflow Vulnerability in Drive of Huawei Smart Phones
There is a stack overflow vulnerabilities in touchscreen drive of some Huawei Smart phones. An attacker tricks a user into installing a malicious application on the smart phone, and send given parameter to touchscreen drive to crash the system or escalate privilege Vulnerability ID:...
Security Advisory - Buffer Overflow Vulnerability in Wi-FI Driver of Huawei Smart Phone
The Wi-Fi driver of some Huawei products has buffer overflow vulnerability due to the lack of a parameters check. An attacker can tricks a user into installing a malicious application on the smart phone, and send given parameter to smart phone to crash the system or escalate privilege...
Security Advisory - Memory Leak Vulnerability in Some Huawei Products
Some Huawei products have a memory leak vulnerability. An unauthenticated attacker may send specific Label Distribution Protocol LDP packets to the devices repeatly. Due to improper validation of some specific fields of the packet, the LDP processing module does not release the memory, resulting ...
Security Advisory - Buffer Overflow Vulnerability in Wi-FI Driver of Huawei Smart Phone
The Wi-Fi driver of some Huawei products has buffer overflow vulnerability due to the lack of a parameters check. An attacker can tricks a user into installing a malicious application on the smart phone, and send given parameter to smart phone to crash the system or escalate privilege...
Security Advisory - E-mail Information Leak Vulnerability in Android System
The Security Bulletin describes an E-mail Information Leak Vulnerability in Android System discovered by Google CVE-2016-3918. An attacker tricks a user into installing a malicious application on the smart phone, and send given parameter to smart phone to obtain information in the...
Security Advisory - DoS Vulnerability in Huawei Firewall
There is a denial of service DoS vulnerability in Huawei firewalls due to no memory release after the execution of a specific command. A remote attacker with specific permission can log in to a device and deliver a large number of such commands to exhaust memory, causing a DoS condition...
Security Advisory - Dirty COW Vulnerability in Huawei Products
In the morning of October 21th, 2016, a security researcher Phil Oester disclosed a local privilege escalation vulnerability in Linux kernel. A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write COW breakage of private read-only memory mappings. An...
Security Advisory - Privilege Escalation Vulnerability in Some Huawei Storage Products
Some Huawei storage products have a privilege escalation vulnerability due to the lack of input validation. Attackers with administrator privilege could inject command into specific command’s parameters, and run this injected command with root privilege. Vulnerability ID: HWPSIRT-2016-05004 This...
Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones
There is Factory Reset Protection FRP bypass security vulnerability in some Huawei smart phones. When re-configuring the mobile phone using the factory reset protection FRP function, an attacker can enter some functional modules without authorization and perform operations to update the Google...
Security Advisory - Command Injection Vulnerability in Huawei FusionAccess
There is a command injection vulnerability in Huawei FusionAccess due to the lack of input validation. A remote attacker with specific permission could inject an Lightweight Directory Access ProtocolLDAP operation command into a specific input variable to obtain sensitive information from the...
Security Advisory - DoS Vulnerability in Huawei Switches
There is a denial of service DoS vulnerability in Huawei switches due to improper management of system resources. A remote attacker with specific permission could store massive files to exhaust the shared storage space, leading to a DoS condition. Vulnerability ID: HWPSIRT-2016-06006 This...
Security Advisory - XSS Vulnerability in Huawei eSpace IAD
Huawei eSpace Integrated Access Device IAD has a reflected cross-site scripting XSS vulnerability. An attacker could trick a user into clicking a URL containing malicious scripts. Then the user's browser may receive a response from the eSpace IAD and execute the malicious scripts. Successful...
Security Advisory - Buffer Overflow Vulnerability in Huawei Firewall Products
The security policy processing module of some Huawei firewall products have a buffer overflow vulnerability. An authenticated attacker may setup a specific security policy into the devices, causing buffer overflow and crash the system. Vulnerability ID: HWPSIRT-2016-06074 This vulnerability has...
Security Advisory - Buffer Overflow Vulnerability in HIFI Driver of Huawei Smart Phone
The HIFI driver of some Huawei products has buffer overflow vulnerability due to the lack of a parameters check. An attacker can get ROOT privilege and send given parameter to driver to crash the system or execute arbitrary code. Vulnerability ID: HWPSIRT-2016-05220 This vulnerability has been...
Security Advisory - Buffer Overflow Vulnerability in TP Driver of Huawei Smart Phone
Touch Panel TP driver of some Huawei products have one buffer overflow vulnerability due to the lack of a parameters check. An attacker can get ROOT privilege and to send given parameter to TP driver to crash the system or execute arbitrary code. Vulnerability ID: HWPSIRT-2016-05224 This...
Security Advisory - Privilege Escalation Vulnerability in the FusionStorage
FusionStorage is a piece of distributed block storage software specifically designed for the storage infrastructure of cloud computing data centers. The maintenance module of Huawei FusionStorage has a privilege escalation vulnerability. After logging in to the FusionStorage successfully as a...
Security Advisory - Multiple Security Vulnerabilities in Huawei Smart Phone Products
The TrustZone driver of some Huawei smart phone products has an input validation vulnerability. An attacker may trick the target user into installing a malicious APP which could exploit this vulnerability to pass specific parameters to the TrustZone driver. Successful exploit could cause the syst...
Security Advisory - Integer Overflow Vulnerability in Some Huawei Devices
Some Huawei devices have an integer overflow vulnerability. Due to the lack of validation in some field of the packet, a remote, unauthenticated attacker may craft specific IPFPM packets, probably causing the device to reset. Vulnerability ID: HWPSIRT-2016-04030 This vulnerability has been assign...
Security Advisory - Unquoted Service Path Vulnerability in Huawei UTPS Software
Huawei Unified Terminal PC suite UTPS, also known as Mobile Partner, runs on the PC side to manage data cards. It provides data card setting, dial-up setting, message sending and receiving, and contacts management functions. Huawei UTPS has an unquoted service path vulnerability which can lead to...
Security Advisory - Buffer Overflow Vulnerability in Some Huawei Products
There is a buffer overflow vulnerability in Connectivity Fault Management CFM function of some Huawei Products. When CFM is enabled and Maintenance Association End Point MEP is configured on the affected device, an adjacent attacker could exploit this vulnerability by sending crafted packets to t...
Security Advisory - Multiple Input Validation Vulnerabilities in Huawei Smart Phone
There are four input validation vulnerabilities in some Huawei Smart phones. An attacker gets the graphic or Camera privilege and tricks a user into installing a malicious application on the smart phone, and send given parameter to smart phone to crash the system or escalate privilege...
Security Advisory - DoS Vulnerability in Some Huawei Firewall Products
Some Huawei firewall products have a denial of service DoS vulnerability. Due to improper validation of some specific fields of DHCP message, an unauthenticated attacker may send abnormal DHCP request packets to the affected products. Successful exploit of this vulnerability could lead to a DoS...
Security Advisory - Input Validation Vulnerability in Some Huawei Products
Some Huawei products have an input validation vulnerability due to improper validation of Multiprotocol Label Switching MPLS packets. A remote unauthenticated attacker could exploit this vulnerability by sending malformed MPLS packets. Successful exploit could lead to a denial of service DoS...
Security Advisory - Input Validation Vulnerability in Wi-Fi Driver of Huawei Smart Phones
There is an input validation vulnerability in the Wi-Fi Driver of some Huawei smart phones. An attacker may trick a user into installing a malicious application, and the application can exploit this vulnerability to gain privileges for certain system calls. Vulnerability ID: HWPSIRT-2016-11026 Th...
Security Notice - Statement on Black Hat Europe 2016 Revealing Security Vulnerability in Huawei Mate Smart Phone
Huawei was notified about information released by Di Shen and Jiahong Fang regarding security vulnerabilities of Broadcom which affect Huawei Mate series smart phone at the Black Hat Europe 2016 conference held in November 2016. According to investigation, Huawei mobile phones are not affected by...
Security Advisory - PXN Defense Mechanism Failure Vulnerability in Huawei Mobile Phones
There is a Privileged Execute-Never PXN defense mechanism failure vulnerability in the drive code of some Huawei mobile phones. An attacker may trick users into installing malicious apps which can disable the PXN defense mechanism by invoking related drive code to crash the system or escalate...
Security Advisory - DOS Vulnerability in ION Memory Management Module of Huawei Smart Phone
A denial of service DoS vulnerability exists in the ION memory management module of some Huawei mobile phones. An attacker may trick a user into installing a malicious app to send specific parameters to a Huawei mobile phone. Successful exploit could cause the system to restart.Vulnerability ID:...
Security Advisory - Two Information Leak Vulnerabilities in ION Memory Management Module of Huawei Smart Phone
Two information leak vulnerabilities exist in the ION memory management module of some Huawei mobile phones due to the lack of initialization during memory allocation. Vulnerability ID: HWPSIRT-2016-09032 and HWPSIRT-2016-09033 These two vulnerabilities have been assigned CVE ID: CVE-2016-8757 an...
Security Advisory - Defense Mechanism Bypass Vulnerability in Huawei USG Products
There is a defense mechanism bypass vulnerability in Huawei USG products. Successful exploit could allow an attacker to bypass the anti-DDoS module of the USGs to send massive HTTP packets, possibly causing a denial of service condition on the backend server. Vulnerability ID: HWPSIRT-2016-07050...
Security Advisory - Hardcoded SSH Key Vulnerability in Some Huawei Storage Products
Some Huawei storage products have a hardcoded SSH key vulnerability. Different nodes of the devices use SSH to encrypt communication data and authenticate each other based on public and private keys. Since the SSH public and private keys are hardcoded, an attacker may obtain the keys and log in t...
Security Advisory - Multiple Security Vulnerabilities in Driver of Huawei Smart Phones
There are two stack overflow vulnerabilities in video driver. An attacker may trick a user into installing a malicious application and the application can send given parameter to video driver to crash the system or escalate user privilege. Vulnerability ID: HWPSIRT-2016-08056 and HWPSIRT-2016-080...
Security Advisory - Path Traversal Vulnerability in Multiple Huawei Products
Multiple Huawei products have a path traversal vulnerability. Due to the insufficient path validation, an authenticated attacker may exploit this vulnerability to download some files without authorization, causing information leak. Vulnerability ID: HWPSIRT-2016-07025 This vulnerability has been...
Security Advisory - Privilege Escalation Vulnerability in Huawei Multiple Smart Phones
There is a privilege escalation vulnerability in Android kernel due to the lack of a parameters check. An attacker may trick a user into installing a malicious application, and the application can modify the data of kernel to crash the system or escalate user privilege. Vulnerability ID:...
Security Advisory - DOS Vulnerability in Video Driver of Huawei Smart Phone
There is a Denial of Service DoS vulnerability in the video driver of some Huawei products. An attacker may trick a user into installing a malicious application, and the application can send given parameter to video driver to reboot the system. Vulnerability ID: HWPSIRT-2016-08046 This...
Security Advisory - DoS Vulnerability in Multiple Huawei Products
There is a DoS vulnerability in some Huawei products. Since the device does not validate the parameters in a certain command, an attacker with certain permissions could log in and deliver the command containing a malicious parameter to make the device restart. Vulnerability ID: HWPSIRT-2016-06064...
Security Advisory - DoS Vulnerability in Multiple Huawei Products
There is a DoS vulnerability in some Huawei products. A remote attacker can directly access the device through a certain URL without login authentication, which can make the device restart. Vulnerability ID: HWPSIRT-2016-06063 This vulnerability has been assigned Common Vulnerabilities and...
Security Advisory - DoS Vulnerability in Huawei Switches
There is a DoS vulnerability caused by memory leak in some of Huawei products as affected products list below. For lacking of adequate input validation，attackers can craft and send a large number of malformed packets to the target device to exhaust the memory of the device and may cause the devic...
Security Advisory - Buffer Overflow Vulnerability in Huawei USG Products
The Point-to-Point Protocol over Ethernet PPPoE module of the USG has a buffer overflow vulnerability. When Challenge Handshake Authentication Protocol CHAP authentication is configured on the server, an attacker may send abnormal attack packets to the server during authentication to cause buffer...
Security Advisory - Two Vulnerabilities in Huawei WS331a
Huawei WS331a is a Mini Wireless route. There is a Cross-site request forgery CSRF vulnerability in the management interface of WS331a products, an unauthenticated attacker could exploit this vulnerability to perform a CSRF attack. Successful exploit could allow the attacker to submit special...
Security Advisory - TCP Connection Hijack Vulnerability
There is a vulnerability in the implementation of the RFC 5961, due to the improper determination of the rate of challenge ACK responses by the global rate limit feature. Successful exploit could allow an unauthenticated, remote attacker to reset or hijack into a TCP connections between two...
Security Advisory - XML Bomb Vulnerability in AnyOffice
AnyOffice Enterprise Mobile Management EMM is a module of the AnyOffice, which provides the mobile terminal management function. The XML Bomb vulnerability in the AnyOffice EMM could allow an authenticated, remote attacker to cause the software to deny services by uploading an XML bomb...
Security Advisory - Multiple Security Vulnerabilities in Huawei HiSuite
Huawei HiSuite PC client software has an information leak vulnerability. The software provides the function for configuring the proxy server. The password textbox on the proxy configuration UI do not disable the password copy function. An attacker who can log in to the system can copy out the...
Security Advisory - Information Leak Vulnerability in Huawei eSpace IAD
Huawei eSpace IAD products have an information leak vulnerability. Some Web pages do not verify the validity of the permission. An attacker can check and download the fault information by access special URL. Vulnerability ID: HWPSIRT-2016-08001 This vulnerability has been assigned a CVE ID:...
Security Advisory - Two Command Injection Vulnerabilities in Huawei UMA
The Unified Maintenance Audit UMA system provides a unified portal for O&M operations, controls and records users' O&M operations, and supports auditing by way of command display and video replay. The UMA has two command injection vulnerabilities due to the lack of validation on special fields. A...
Security Advisory - Reset Password and Information Leak Vulnerabilities in Huawei UMA
The Unified Maintenance Audit UMA system provides a unified portal for O&M operations, controls and records users' O&M operations, and supports auditing by way of command display and video replay. The UMA has two security vulnerabilities. One vulnerability is due to insufficient parameter...
Security Advisory - IPv6 Neighbor Discovery Crafted Packet Denial of Service Vulnerability
There is a vulnerability in the IP Version 6 IPv6 Neighbor Discovery packet process of multiple products, successful exploit could allow an unauthenticated, remote attacker to cause an affected device to start dropping legitimate IPv6 neighbors as legitimate ND times out, leading to a denial of...
Security Advisory - XXE Vulnerability in the E9000
E9000 has an XML External Entity XXE vulnerability when parsing user-supplied XML documents in HMM Hyper Management Module. Attackers could exploit this vulnerability to read arbitrary files and cause a denial of the web service. Vulnerability ID: HWPSIRT-2016-05249 This vulnerability has been...
Security Advisory - Uncontrolled Format String Vulnerability on Multiple Products
Several Huawei routers and switches have an uncontrolled format string vulnerability when processing partial commands. An authenticated attacker could exploit this vulnerability to cause a denial of service. Vulnerability ID: HWPSIRT-2016-07011 This vulnerability has been assigned Common...
Security Advisory - Resource Management Vulnerability in Huawei Servers
Some Huawei servers have a resource management vulnerability in the iBMC Intelligent Baseboard Management Controller. A local attacker could exploit this vulnerability to exhaust iBMC resources and cause a denial of service. Vulnerability ID: HWPSIRT-2016-05251 This vulnerability has been assigne...