High severity · published Aug 28, 2017
CVE-2015-8332
Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which allows remote authenticated users to…
8.8
CVSS
1%
EPSS
No
On KEV
Description
Huawei Video Content Management (VCM) before V100R001C10SPC001 does not properly "authenticate online user identities and privileges," which allows remote authenticated users to gain privileges and perform a case operation as another user via a crafted message, aka "Horizontal Privilege Escalation Vulnerability."
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VF
Vcm5010 Firmware · Huawei
through v100r001c10b010 · source: NVD
VF
Vcm5020 Firmware · Huawei
through v100r001c10b010 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-8332
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-8332
Vendor Advisory
http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-462985.htm
More from Vcm5010 Firmware
9.8
CVE-2017-2738
VCM5010 with software versions earlier before V100R002C50SPC100 has an authentication bypass vulnerability
8.8
CVE-2017-2737
VCM5010 with software versions earlier before V100R002C50SPC100 has an arbitrary file upload vulnerability
7.2
CVE-2017-2736
VCM5010 with software versions earlier before V100R002C50SPC100 has a command injection vulnerability