PT-2016-7132 · Huawei · Xh620 V3+8

Published 2016-09-07 · Updated 2016-09-09 · CVE-2016-6838

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Huawei X6800 and XH620 V3 servers versions prior to V100R003C00SPC606 Huawei RH1288 V3 servers versions prior to V100R003C00SPC613 Huawei RH2288 V3 servers versions prior to V100R003C00SPC617 Huawei CH140 V3 and CH226 V3 servers versions prior to V100R001C00SPC122 Huawei CH220 V3 servers versions prior to V100R001C00SPC201 Huawei CH121 V3 and CH222 V3 servers versions prior to V100R001C00SPC202

Description The issue allows remote attackers to decrypt encrypted data, potentially obtaining sensitive information, by leveraging the selection of an insecure SSH encryption algorithm.

Recommendations For Huawei X6800 and XH620 V3 servers versions prior to V100R003C00SPC606, update to V100R003C00SPC606 or later. For Huawei RH1288 V3 servers versions prior to V100R003C00SPC613, update to V100R003C00SPC613 or later. For Huawei RH2288 V3 servers versions prior to V100R003C00SPC617, update to V100R003C00SPC617 or later. For Huawei CH140 V3 and CH226 V3 servers versions prior to V100R001C00SPC122, update to V100R001C00SPC122 or later. For Huawei CH220 V3 servers versions prior to V100R001C00SPC201, update to V100R001C00SPC201 or later. For Huawei CH121 V3 and CH222 V3 servers versions prior to V100R001C00SPC202, update to V100R001C00SPC202 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-310

CWE-200

Related Identifiers

CVE-2016-6838

Affected Products

Ch121 V3

Ch140 V3

Ch220 V3

Ch222 V3

Ch226 V3

Rh1288 V3

Rh2288 V3

X6800

Xh620 V3

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-6838 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6838 · Vendor Advisory
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20160817-02-server-en · Vendor Advisory
• http://securityfocus.com/bid/92503 · Note