High severity · published Oct 10, 2017
CVE-2015-7842
Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before…
7.1
CVSS
0.7%
EPSS
No
On KEV
Description
Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allow remote authenticated operators to change server information by leveraging failure to verify user permissions.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CV
Ch121 V3 Firmware · Huawei
through v100r001c00 · source: NVD
CV
Ch220 V3 Firmware · Huawei
through v100r001c00 · source: NVD
CV
Ch222 V3 Firmware · Huawei
through v100r001c00 · source: NVD
RV
Rh1288 V3 Firmware · Huawei
through v100r003c00spc100 · source: NVD
RV
Rh1288a V2 Firmware · Huawei
through v100r002c00 · source: NVD
RV
Rh2288 V3 Firmware · Huawei
through v100r003c00 · source: NVD
RV
Rh2288a V2 Firmware · Huawei
through v100r002c00 · source: NVD
RV
Rh2288h V3 Firmware · Huawei
through v100r003c00 · source: NVD
RV
Rh8100 V3 Firmware · Huawei
through v100r003c00 · source: NVD
XV
Xh628 V3 Firmware · Huawei
through v100r003c00 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7842
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7842
Third Party Advisory
http://www.securityfocus.com/bid/76836
Vendor Advisory
http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-454418.htm
More from Ch121 V3 Firmware
8.8
CVE-2018-7943
There is an authentication bypass vulnerability in some Huawei servers
8.8
CVE-2018-7951
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation
8.8
CVE-2018-7950
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation
8.8
CVE-2018-7949
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability
8.8
CVE-2018-7941
Huawei iBMC V200R002C60 have an authentication bypass vulnerability