PT-2017-6383 · Huawei · Ws318

Dominique Bongard · Publicado 2017-04-02 · Atualizado 2017-04-05 · CVE-2014-9690

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Huawei home gateways WS318 versions V100R001C01B022 and earlier

Description The issue affects the WPS protocol due to a PIN offline brute force cracking vulnerability. This is caused by the random number generator (RNG) used in the supplier's solution not being random enough, making it easier for an attacker to brute force crack the PIN code. Once the PIN is cracked, the attacker can access the Internet via the compromised device.

Recommendations For versions V100R001C01B022 and earlier, consider disabling the WPS protocol until a patch is available to prevent brute force cracking of the PIN code. Restrict access to the device to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-332

Identificadores relacionados

CVE-2014-9690

Produtos afetados

Ws318

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2014-9690 · Nota de Segurança
• http://huawei.com/en/psirt/security-advisories/hw-408091 · Aviso do Fabricante