PT-2015-3308 · Huawei · S9700+7

Published 2015-03-19 · Updated 2017-06-20 · CVE-2015-2800

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Huawei Campus switches S5700, S5300, S6300, and S6700 versions prior to V200R001SPH012 Huawei Campus switches S7700, S9300, and S9700 versions prior to V200R001SPH015

Description The issue is related to the user authentication module, which allows remote attackers to cause a denial of service, resulting in a device restart. This is triggered by vectors involving authentication that cause an array access violation. The vulnerability is due to flaws in the authentication procedure, specifically an array initialization issue. Exploitation of this issue can allow a remote attacker to cause a denial of service using authentication vectors that trigger an array access violation.

Recommendations For Huawei Campus switches S5700, S5300, S6300, and S6700 versions prior to V200R001SPH012, update to version V200R001SPH012 or later. For Huawei Campus switches S7700, S9300, and S9700 versions prior to V200R001SPH015, update to version V200R001SPH015 or later.

Fix

DoS

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2017-02146

CVE-2015-2800

Affected Products

Huawei Vrp

S5300

S5700

S6300

S6700

S7700

S9300

S9700

References · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2800 · Security Note
• http://huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-418554.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2800 · Security Note
• https://bdu.fstec.ru/vul/2017-02146 · Security Note
• http://securityfocus.com/bid/73355 · Note
• https://huawei.com/en/psirt/security-advisories/hw-418554 · Note