Security Advisory - DoS Vulnerability in Huawei CE Series Switches
- SA No:Huawei-SA-20160113-01-Switch
- Initial Release Date: Jan 13, 2016
- Last Release Date: Jan 13, 2016
Huawei CE series switches are high-performance switches designed for next-generation data centers.
The CE series switches have a DoS vulnerability. An attacker logs in to the switches multiple times using a non-administrator account through a specific protocol to exploit this vulnerability. Successful exploitation can cause the device to restart. (Vulnerability ID: HWPSIRT-2015-11063)
Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160113-01-switch-en
|
Product Name |
Affected Version |
Resolved Product and Version |
|
CloudEngine 12800 |
V100R005C00 |
V100R005SPH003 |
An attacker can exploit this vulnerability to launch a DoS attack to a device, causing it to restart.
The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).
Base Score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Temporal Score: 3.3 (E:F/RL:O/RC:C)
Prerequisite:
1.The attacker has logged in to a CE switch using a non-administrator account through a specific protocol.
Attacking procedure:
A server can identify administrator accounts and forcibly log out non-administrator users. Besides, the server does not restrict the login times of non-administrator accounts. The attacker can log in to a CE switch multiple times using a non-administrator account through a specific protocol to launch a DoS attack to the CE switch, causing it to restart.
This vulnerability was reported by Huawei internal tester.
None
This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.
