PT-2014-8475 · Huawei · Huawei Hilink E3276+1

Published 2014-10-20 · Updated 2017-09-08 · CVE-2014-8331

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Huawei HiLink E3236 versions before E3236sTCPU-V200R002B470D13SP00C00 Huawei HiLink E3236 versions before E3236sWebUI-V100R007B100D03SP01C03 Huawei HiLink E3276 versions before E3276sTCPU-V200R002B146D41SP00C00 Huawei HiLink E3276 versions before E3276sWebUI-V100R007B100D03SP01C03

Description The issue allows remote attackers to hijack the authentication of administrators for requests that change configuration settings or use device functions due to multiple cross-site request forgery (CSRF) vulnerabilities.

Recommendations For Huawei HiLink E3236 versions before E3236sTCPU-V200R002B470D13SP00C00, update to a version that includes the fix. For Huawei HiLink E3236 versions before E3236sWebUI-V100R007B100D03SP01C03, update to a version that includes the fix. For Huawei HiLink E3276 versions before E3276sTCPU-V200R002B146D41SP00C00, update to a version that includes the fix. For Huawei HiLink E3276 versions before E3276sWebUI-V100R007B100D03SP01C03, update to a version that includes the fix.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-8331

Affected Products

Huawei Hilink E3236

Huawei Hilink E3276

References · 4

• http://huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-360246.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-8331 · Security Note
• http://osvdb.org/show/osvdb/109885 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95198 · Note