PT-2012-6212 · Huawei · Huawei E585

John Bird · Publicado 2012-12-19 · Atualizado 2012-12-19 · CVE-2012-5969

Positive Technologies (AI Summary)

CVSS v2.0

4.8

Média

Vetor base

AV:A/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Huawei E585 device (affected versions not specified)

Description The issue allows remote attackers to read or modify arbitrary files on the device. This can be achieved through directory traversal vulnerabilities, specifically by using a .. (dot dot) in the PATH INFO of an "sdcard/" request or in the req page parameter to the "en/sms.cgi" endpoint.

Recommendations For the Huawei E585 device, consider restricting access to the "sdcard/" directory and the "en/sms.cgi" endpoint until a fix is available. As a temporary workaround, avoid using the req page parameter in the "en/sms.cgi" endpoint to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2012-5969

Produtos afetados

Huawei E585

Referências · 3

• http://kb.cert.org/vuls/id/871148 · Nota
• http://huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-198239.htm · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-5969 · Nota de Segurança