Security Advisory-Authority Control Vulnerability in Quidway Switches
- SA No:Huawei-SA-20150121-01-Quidway Switches
- Initial Release Date: Jan 21, 2015
- Last Release Date: Mar 20, 2015
Huawei Quidway switches have the authority control vulnerability in access authentication, which may be exploited by attackers to obtain higher access permissions. (Vulnerability ID: HWPSIRT-2014-11119)
This Vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2015-1460.
Currently, official fixes are available.
|
Product Name |
Affected Version |
Solved version |
|
Quidway S2350 |
V200R003C00SPC300 |
V200R005C00SPC300 |
|
Quidway S2750 |
V200R003C00SPC300 |
V200R005C00SPC300 |
|
Quidway S5300 |
V200R003C00SPC300 |
V200R005C00SPC300 |
|
Quidway S5700 |
V200R003C00SPC300 |
V200R005C00SPC300 |
|
Quidway S6300 |
V200R003C00SPC300 |
V200R005C00SPC300 |
|
Quidway S6700 |
V200R003C00SPC300 |
V200R005C00SPC300 |
|
Quidway S7700 |
V200R003C00SPC300 V200R003C00SPC500 |
V200R005C00SPC300 |
|
Quidway S9300 Quidway S9300E |
V200R003C00SPC300 V200R003C00SPC500 |
V200R005C00SPC300 |
|
Quidway S9700 |
V200R003C00SPC300 V200R003C00SPC500 |
V200R005C00SPC300 |
The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).
Base Score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Temporal Score: 4.1 (E:F/RL:O/RC:C)
Overall Score: 4.1
This vulnerability can be exploited only when the following conditions are present:
- The attacker can access the network.
Vulnerability details:
During access authentication, Huawei Quidway switches insufficiently process specific packets, resulting in the authority control vulnerability. Attackers may exploit this vulnerability to obtain higher access permissions.
For security problems about Huawei products and solutions, please contactPSIRT@huawei.com.
For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.
2015-3-20 V1.2 UPDATED Summary
2015-1-23 V1.1 UPDATED Solved version
2015-1-21 V1.0 INITIAL
None
