PT-2017-6383 · Huawei · Ws318

Dominique Bongard · Published 2017-04-02 · Updated 2017-04-05 · CVE-2014-9690

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Huawei home gateways WS318 versions V100R001C01B022 and earlier

Description The issue affects the WPS protocol due to a PIN offline brute force cracking vulnerability. This is caused by the random number generator (RNG) used in the supplier's solution not being random enough, making it easier for an attacker to brute force crack the PIN code. Once the PIN is cracked, the attacker can access the Internet via the compromised device.

Recommendations For versions V100R001C01B022 and earlier, consider disabling the WPS protocol until a patch is available to prevent brute force cracking of the PIN code. Restrict access to the device to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-332

Related Identifiers

CVE-2014-9690

Affected Products

Ws318

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2014-9690 · Security Note
• http://huawei.com/en/psirt/security-advisories/hw-408091 · Vendor Advisory