PT-2015-7724 · Huawei · Quidway S9300+7

Aristide Fattori + 1 · Published 2015-09-30 · Updated 2016-11-28 · CVE-2015-8086

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Huawei AR routers versions prior to V200R007C00SPC100 Quidway S9300 routers versions prior to V200R009C00 S12700 routers versions prior to V200R008C00SPC500 S9300, Quidway S5300, and S5300 routers versions prior to V200R007C00 S5700 routers versions prior to V200R007C00SPC500

Description The issue makes it easier for remote authenticated administrators to obtain encryption keys and ciphertext passwords via vectors related to key storage. Encryption keys are stored in the system, allowing an attacker to implement reverse engineering to obtain the encryption keys.

Recommendations For Huawei AR routers versions prior to V200R007C00SPC100, update to V200R007C00SPC100 or later. For Quidway S9300 routers versions prior to V200R009C00, update to V200R009C00 or later. For S12700 routers versions prior to V200R008C00SPC500, update to V200R008C00SPC500 or later. For S9300, Quidway S5300, and S5300 routers versions prior to V200R007C00, update to V200R007C00 or later. For S5700 routers versions prior to V200R007C00SPC500, update to V200R007C00SPC500 or later.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2015-8086

Affected Products

Huawei Ar

Huawei Vrp

Quidway S5300

Quidway S9300

S12700

S5300

S5700

S9300

References · 5

• http://huawei.com/en/psirt/security-advisories/hw-455876 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8086 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-8086 · Security Note
• http://securityfocus.com/bid/76897 · Note
• https://huawei.com/en/psirt/security-advisories/hw-455876 · Note