PT-2017-9807 · Huawei · Huawei Fusionaccess

Published 2017-04-02 · Updated 2017-04-05 · CVE-2016-8779

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Huawei FusionAccess versions V100R005C10 through V100R005C20

Description The issue allows remote attackers with specific permission to inject a Lightweight Directory Access Protocol (LDAP) operation command into a specific input variable, potentially obtaining sensitive information from the database.

Recommendations For versions V100R005C10 and V100R005C20, consider restricting access to the input variable that allows LDAP operation command injection to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2016-8779

Affected Products

Huawei Fusionaccess

References · 4

• http://huawei.com/en/psirt/security-advisories/huawei-sa-20161130-01-ldap-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8779 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8779 · Vendor Advisory
• http://securityfocus.com/bid/94620 · Note