PT-2016-3889 · Huawei · Huawei Vcn500

Published 2016-01-11 · Updated 2016-01-11 · CVE-2015-8331

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Huawei VCN500 versions prior to V100R002C00SPC200

Description The issue arises from the Operation and Maintenance Unit (OMU) in Huawei VCN500, where it fails to properly invalidate the session ID when an abnormal exit occurs. This allows remote attackers to conduct replay attacks via the session ID.

Recommendations For versions prior to V100R002C00SPC200, update to V100R002C00SPC200 or later to resolve the issue. As a temporary workaround, consider implementing additional session validation mechanisms to minimize the risk of replay attacks.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-8331

Affected Products

Huawei Vcn500

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2015-8331 · Security Note
• http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-463067.htm · Vendor Advisory