Security Advisory - Path Traversal Vulnerability in Huawei Home Gateway Products
- SA No:Huawei-SA-20151124-01-HomeGateway
- Initial Release Date: Nov 24, 2015
- Last Release Date: Nov 11, 2016
There is a path traversal vulnerability on several Huawei home gateway products. The products do not properly validate HTTP requests received by a specific port. An remote attacker may access the local files on the device without authentication by crafting an HTTP request and sending it to the specific port. (Vulnerability ID: HWPSIRT-2015-09006)
This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2015-7254.
Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-462908.htm
|
Product Name |
Affected Version |
Resolved Product and Version |
|
HG532e |
Versions earlier than V100R001C02B017 |
V100R001C02B017 |
|
WS318-10 |
Versions earlier than V100R001C01B022 |
V100R001C01B022 |
|
WS550-10 |
Versions earlier than V100R001C01B019 |
V100R001C01B019 |
Attackers may access the local files on the device without authentication.
The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).
Base Score: 5.0 (AV:N/AC:L/Au:N/P:C/I:N/A:N)
Temporal Score: 4.1 (E:F/RL:O/RC:C)
1. Prerequisite:
The attacker gains access to the network of the device.
2. Attacking procedure:
An attacker may craft an HTTP request and send it to a specific port on the device. The device does not properly validate the packet. By exploiting this vulnerability, the remote attacker can launch the path traversal attack and access the local files on the device, but the attacker cannot perform modify or delete operation.
This vulnerability was reported by CERT/CC. Huawei PSIRT is not aware of malicious use of the vulnerability described in this advisory.
Huawei express our appreciation for CERT/CC’s concerns on Huawei products.
For security problems about Huawei products and solutions, please contactPSIRT@huawei.com.
For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.
2016-11-11 V1.1 UPDATED Updated information of "Software Versions and Fixes"
2015-11-24 V1.0 INITIAL
None
