PT-2016-3889 · Huawei · Huawei Vcn500

Publicado 2016-01-11 · Atualizado 2016-01-11 · CVE-2015-8331

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Huawei VCN500 versions prior to V100R002C00SPC200

Description The issue arises from the Operation and Maintenance Unit (OMU) in Huawei VCN500, where it fails to properly invalidate the session ID when an abnormal exit occurs. This allows remote attackers to conduct replay attacks via the session ID.

Recommendations For versions prior to V100R002C00SPC200, update to V100R002C00SPC200 or later to resolve the issue. As a temporary workaround, consider implementing additional session validation mechanisms to minimize the risk of replay attacks.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2015-8331

Produtos afetados

Huawei Vcn500

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2015-8331 · Nota de Segurança
• http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-463067.htm · Aviso do Fabricante