PT-2017-18142 · Huawei · Imanager Neteco+1

Published 2017-05-31 · Updated 2017-12-07 · CVE-2017-8133

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Huawei iManager NetEco versions V600R008C00 through V600R008C10

Description The issue is related to a command injection vulnerability due to insufficient input validation. An authenticated, remote attacker could exploit this vulnerability to send malicious packets to a target device. Successful exploitation could enable a low privileged user to execute commands that a high privileged user could execute, potentially causing files to be tampered with or deleted.

Recommendations For versions V600R008C00 and V600R008C10, consider restricting access to the system until a patch is available to prevent low privileged users from executing high privileged commands. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2017-8133

Affected Products

Huawei Vrp

Imanager Neteco

References · 3

• http://huawei.com/en/psirt/security-advisories/huawei-sa-20170531-01-neteco-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8133 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8133 · Security Note