PT-2014-3569 · Huawei · Huawei Echo Life Hg8247

Rijnard Van Tonder · Publicado 2014-04-05 · Atualizado 2014-04-07 · CVE-2014-0337

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Huawei Echo Life HG8247 routers versions prior to V100R006C00SPC127

Description A cross-site scripting (XSS) issue exists in the web interface, allowing remote attackers to inject arbitrary web script or HTML via a crafted username in an invalid TELNET connection attempt. This occurs because the username is not properly handled during the construction of the "failed log-in attempts over telnet" log view.

Recommendations For versions prior to V100R006C00SPC127, update to V100R006C00SPC127 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation. Avoid using the username variable in the affected log view until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-0337

Produtos afetados

Huawei Echo Life Hg8247

Referências · 2

• http://kb.cert.org/vuls/id/917700 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0337 · Nota de Segurança