PT-2014-8475 · Huawei · Huawei Hilink E3276+1

Publicado 2014-10-20 · Atualizado 2017-09-08 · CVE-2014-8331

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Huawei HiLink E3236 versions before E3236sTCPU-V200R002B470D13SP00C00 Huawei HiLink E3236 versions before E3236sWebUI-V100R007B100D03SP01C03 Huawei HiLink E3276 versions before E3276sTCPU-V200R002B146D41SP00C00 Huawei HiLink E3276 versions before E3276sWebUI-V100R007B100D03SP01C03

Description The issue allows remote attackers to hijack the authentication of administrators for requests that change configuration settings or use device functions due to multiple cross-site request forgery (CSRF) vulnerabilities.

Recommendations For Huawei HiLink E3236 versions before E3236sTCPU-V200R002B470D13SP00C00, update to a version that includes the fix. For Huawei HiLink E3236 versions before E3236sWebUI-V100R007B100D03SP01C03, update to a version that includes the fix. For Huawei HiLink E3276 versions before E3276sTCPU-V200R002B146D41SP00C00, update to a version that includes the fix. For Huawei HiLink E3276 versions before E3276sWebUI-V100R007B100D03SP01C03, update to a version that includes the fix.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2014-8331

Produtos afetados

Huawei Hilink E3236

Huawei Hilink E3276

Referências · 4

• http://osvdb.org/show/osvdb/109885 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95198 · Nota
• http://huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-360246.htm · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-8331 · Nota de Segurança