PT-2016-3945 · Huawei · Huawei S5300 Campus Series+1

Published 2016-01-12 · Updated 2016-01-21 · CVE-2015-8675

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Huawei S5300 Campus Series switches versions prior to V200R005SPH008

Description The issue concerns an information exposure problem where passwords are not masked when uploading files to certain directories, allowing physically proximate attackers to obtain sensitive password information by reading the display. This occurs because the system does not hide passwords entered by the user, leading to potential password leaks.

Recommendations For versions prior to V200R005SPH008, consider disabling the file upload feature to the affected directories until a patch is available. Restrict physical access to the switches to minimize the risk of exploitation. Update to a version V200R005SPH008 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2015-8675

Affected Products

Huawei S5300 Campus Series

Huawei Vrp

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-8675 · Security Note
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20160112-01-switch-en · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8675 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20160112-01-switch-en · Note