PT-2013-1583 · Huawei+1 · Switch+14

Kurt Grutzmacher · Published 2013-02-01 · Updated 2021-04-06 · CVE-2012-3268

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions HP Access Controller versions (affected versions not specified) HP Fabric Module versions (affected versions not specified) HP Firewall versions (affected versions not specified) HP Router versions (affected versions not specified) HP Switch versions (affected versions not specified) HP UTM Appliance versions (affected versions not specified) HP 3Com Access Controller versions (affected versions not specified) HP 3Com Router versions (affected versions not specified) HP 3Com Switch versions (affected versions not specified) HP H3C Access Controller versions (affected versions not specified) HP H3C Firewall versions (affected versions not specified) HP H3C Router versions (affected versions not specified) HP H3C Switch versions (affected versions not specified) HP H3C Switch and Route Processing Unit versions (affected versions not specified) Huawei Firewall/Gateway versions (affected versions not specified) Huawei Router versions (affected versions not specified) Huawei Switch versions (affected versions not specified) Huawei Wireless versions (affected versions not specified)

Description The issue is related to improper implementation of access control, allowing remote authenticated users to discover credentials via an SNMP request. This is possible due to the read-only community in h3c-user.mib 2.0 and hh3c-user.mib 2.0.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2012-3268

Affected Products

H3C Access Controller

3Com Router

3Com Switch

Access Controller

Fabric Module

Firewall

Firewall/Gateway

H3C Firewall

H3C Router

H3C Switch

H3C Switch/Route Processing Unit

Router

Switch

Ufm Appliance

Wireless

References · 10

• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03515685 · Vendor Advisory
• http://support.huawei.com/enterprise/NewsReadAction.action?newType=0301&contentId=NEWS1000001165&idAbsPath=0301_10001&nameAbsPath=Services%2520News · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3268 · Security Note
• http://securityfocus.com/bid/56183 · Note
• http://kb.cert.org/vuls/id/225404 · Note
• http://grutztopia.jingojango.net/2012/10/hph3c-and-huawei-snmp-weak-access-to.html · Note
• http://securitytracker.com/id?1027694 · Note
• http://support.huawei.com/support/pages/news/NewsInfoAction.do?doc_id=IN0000054930&colID=ROOTENWEB%7CCO0000000170&actionFlag=view · Note
• http://archives.neohapsis.com/archives/bugtraq/2012-10/0123.html · Note
• http://kb.cert.org/vuls/id/MORO-8ZDJDP · Note