PT-2015-3330 · Huawei · Huawei Fusionserver Rh2288H V3+8

Published 2015-09-23 · Updated 2017-10-23 · CVE-2015-7841

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Huawei FusionServer RH2288 V3 versions prior to V100R003C00SPC603 Huawei FusionServer RH2288H V3 versions prior to V100R003C00SPC503 Huawei FusionServer XH628 V3 versions prior to V100R003C00SPC602 Huawei FusionServer RH1288 V3 versions prior to V100R003C00SPC602 Huawei FusionServer RH2288A V2 versions prior to V100R002C00SPC701 Huawei FusionServer RH1288A V2 versions prior to V100R002C00SPC502 Huawei FusionServer RH8100 V3 versions prior to V100R003C00SPC110 Huawei FusionServer CH222 V3 versions prior to V100R001C00SPC161 Huawei FusionServer CH220 V3 versions prior to V100R001C00SPC161 Huawei FusionServer CH121 V3 versions prior to V100R001C00SPC161

Description The issue is related to the lack of input data sanitization on the login page of the server, allowing remote attackers to bypass access restrictions and execute arbitrary commands via unspecified parameters. This can be demonstrated by a "user creation command." The vulnerability may allow a remote attacker to bypass access restrictions and execute commands.

Recommendations For Huawei FusionServer RH2288 V3 versions prior to V100R003C00SPC603, update to V100R003C00SPC603 or later. For Huawei FusionServer RH2288H V3 versions prior to V100R003C00SPC503, update to V100R003C00SPC503 or later. For Huawei FusionServer XH628 V3 versions prior to V100R003C00SPC602, update to V100R003C00SPC602 or later. For Huawei FusionServer RH1288 V3 versions prior to V100R003C00SPC602, update to V100R003C00SPC602 or later. For Huawei FusionServer RH2288A V2 versions prior to V100R002C00SPC701, update to V100R002C00SPC701 or later. For Huawei FusionServer RH1288A V2 versions prior to V100R002C00SPC502, update to V100R002C00SPC502 or later. For Huawei FusionServer RH8100 V3 versions prior to V100R003C00SPC110, update to V100R003C00SPC110 or later. For Huawei FusionServer CH222 V3 versions prior to V100R001C00SPC161, update to V100R001C00SPC161 or later. For Huawei FusionServer CH220 V3 versions prior to V100R001C00SPC161, update to V100R001C00SPC161 or later. For Huawei FusionServer CH121 V3 versions prior to V100R001C00SPC161, update to V100R001C00SPC161 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2017-02428

CVE-2015-7841

Affected Products

Huawei Fusionserver Ch121 V3

Huawei Fusionserver Ch220 V3

Huawei Fusionserver Ch222 V3

Huawei Fusionserver Rh1288 V3

Huawei Fusionserver Rh1288A V2

Huawei Fusionserver Rh2288H V3

Huawei Fusionserver Rh2288A V2

Huawei Fusionserver Rh8100 V3

Huawei Fusionserver Xh628 V3

References · 4

• https://bdu.fstec.ru/vul/2017-02428 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-7841 · Security Note
• http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-454418.htm · Vendor Advisory
• http://securityfocus.com/bid/76836 · Note