PT-2012-5693 · Huawei · E200E-X7/Usg5100+64

Kurt Grutzmacher · Published 2012-08-27 · Updated 2013-08-22 · CVE-2012-4960

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Huawei NE5000E (affected versions not specified) Huawei MA5200G (affected versions not specified) Huawei NE40E (affected versions not specified) Huawei NE80E (affected versions not specified) Huawei ATN (affected versions not specified) Huawei NE40 (affected versions not specified) Huawei NE80 (affected versions not specified) Huawei NE20E-X6 (affected versions not specified) Huawei NE20 (affected versions not specified) Huawei ME60 (affected versions not specified) Huawei CX600 (affected versions not specified) Huawei CX200 (affected versions not specified) Huawei CX300 (affected versions not specified) Huawei ACU (affected versions not specified) Huawei WLAN AC 6605 (affected versions not specified) Huawei S9300 (affected versions not specified) Huawei S7700 (affected versions not specified) Huawei S2300 (affected versions not specified) Huawei S3300 (affected versions not specified) Huawei S5300 (affected versions not specified) Huawei S3300HI (affected versions not specified) Huawei S5300HI (affected versions not specified) Huawei S5306 (affected versions not specified) Huawei S6300 (affected versions not specified) Huawei S2700 (affected versions not specified) Huawei S3700 (affected versions not specified) Huawei S5700 (affected versions not specified) Huawei S6700 (affected versions not specified) Huawei AR G3 (affected versions not specified) Huawei H3C AR(OEM IN) (affected versions not specified) Huawei AR 19 (affected versions not specified) Huawei AR 29 (affected versions not specified) Huawei AR 49 (affected versions not specified) Huawei Eudemon100E (affected versions not specified) Huawei Eudemon200 (affected versions not specified) Huawei Eudemon300 (affected versions not specified) Huawei Eudemon500 (affected versions not specified) Huawei Eudemon1000 (affected versions not specified) Huawei Eudemon1000E-U/USG5300 (affected versions not specified) Huawei Eudemon1000E-X/USG5500 (affected versions not specified) Huawei Eudemon8080E/USG9300 (affected versions not specified) Huawei Eudemon8160E/USG9300 (affected versions not specified) Huawei Eudemon8000E-X/USG9500 (affected versions not specified) Huawei E200E-C/USG2200 (affected versions not specified) Huawei E200E-X3/USG2200 (affected versions not specified) Huawei E200E-X5/USG2200 (affected versions not specified) Huawei E200E-X7/USG2200 (affected versions not specified) Huawei E200E-C/USG5100 (affected versions not specified) Huawei E200E-X3/USG5100 (affected versions not specified) Huawei E200E-X5/USG5100 (affected versions not specified) Huawei E200E-X7/USG5100 (affected versions not specified) Huawei E200E-B/USG2100 (affected versions not specified) Huawei E200E-X1/USG2100 (affected versions not specified) Huawei E200E-X2/USG2100 (affected versions not specified) Huawei SVN5300 (affected versions not specified) Huawei SVN2000 (affected versions not specified) Huawei SVN5000 (affected versions not specified) Huawei SVN3000 (affected versions not specified) Huawei NIP100 (affected versions not specified) Huawei NIP200 (affected versions not specified) Huawei NIP1000 (affected versions not specified) Huawei NIP2100 (affected versions not specified) Huawei NIP2200 (affected versions not specified) Huawei NIP5100 (affected versions not specified)

Description The issue is related to the use of the DES algorithm for stored passwords in multiple Huawei products, which makes it easier for attackers to obtain cleartext passwords via a brute-force attack. The DES encryption algorithm used for password storage is not strong enough and may be cracked.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2012-4960

Affected Products

Acu

Ar 19

Ar 29

Ar 49

Ar G3

Atn

Cx200

Cx300

Cx600

E200E-B/Usg2100

E200E-C/Usg2200

E200E-C/Usg5100

E200E-X1/Usg2100

E200E-X2/Usg2100

E200E-X3/Usg2200

E200E-X3/Usg5100

E200E-X5/Usg2200

E200E-X5/Usg5100

E200E-X7/Usg2200

E200E-X7/Usg5100

Eudemon1000

Eudemon1000E-U/Usg5300

Eudemon1000E-X/Usg5500

Eudemon100E

Eudemon200

Eudemon300

Eudemon500

Eudemon8000E-X/Usg9500

Eudemon8080E/Usg9300

Eudemon8160E/Usg9300

H3C Ar

Huawei Vrp

Ma5200G

Me60

Ne20

Ne20E-X6

Ne40

Ne40E

Ne5000E

Ne80

Ne80E

Nip100

Nip1000

Nip200

Nip2100

Nip2200

Nip5100

S2300

S2700

S3300

S3300Hi

S3700

S5300

S5300Hi

S5306

S5700

S6300

S6700

S7700

S9300

Svn2000

Svn3000

Svn5000

Svn5300

Wlan Ac 6605

References · 6

• 🔥 https://exploit-db.com/exploits/38020 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4960 · Security Note
• http://huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-u_194373.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4960 · Security Note
• https://huawei.com/en/psirt/security-advisories/hw-u_194373 · Note
• http://kb.cert.org/vuls/id/948096 · Note