PT-2014-3569 · Huawei · Huawei Echo Life Hg8247

Rijnard Van Tonder · Published 2014-04-05 · Updated 2014-04-07 · CVE-2014-0337

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Huawei Echo Life HG8247 routers versions prior to V100R006C00SPC127

Description A cross-site scripting (XSS) issue exists in the web interface, allowing remote attackers to inject arbitrary web script or HTML via a crafted username in an invalid TELNET connection attempt. This occurs because the username is not properly handled during the construction of the "failed log-in attempts over telnet" log view.

Recommendations For versions prior to V100R006C00SPC127, update to V100R006C00SPC127 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation. Avoid using the username variable in the affected log view until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-0337

Affected Products

Huawei Echo Life Hg8247

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2014-0337 · Security Note
• http://kb.cert.org/vuls/id/917700 · Note