PT-2016-5653 · Huawei · Quidway S9700+5

Published 2016-03-30 · Updated 2016-04-14 · CVE-2016-3678

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Huawei Quidway S9700, S5700, S5300, S9300, and S7700 switches with software before V200R003SPH012 Huawei S series switches (affected versions not specified)

Description The issue allows remote attackers to cause a denial of service, resulting in a switch restart, via crafted traffic. An attacker can exploit this by controlling or impersonating a server connected to a switch and sending malicious attack packets to cause the switch to restart and become unavailable.

Recommendations For Huawei Quidway S9700, S5700, S5300, S9300, and S7700 switches with software before V200R003SPH012, update to a version V200R003SPH012 or later. For other affected Huawei S series switches, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-3678

Affected Products

Huawei Vrp

Quidway S9700

S5300

S5700

S7700

S9300

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2016-3678 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3678 · Vendor Advisory
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20160330-01-switch-en · Vendor Advisory