Medium severity · published Jan 12, 2016
CVE-2015-8673
Huawei TE30, TE40, TE50, and TE60 multimedia video conferencing endpoints with software before V100R001C10SPC100 do not require entry of the old password when changing the…
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
Huawei TE30, TE40, TE50, and TE60 multimedia video conferencing endpoints with software before V100R001C10SPC100 do not require entry of the old password when changing the password for the Debug account, which allows physically proximate attackers to change the password by leveraging an unattended workstation.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
Te30 · Huawei
All versions, or not specified · source: NVD
TE
Te40 · Huawei
All versions, or not specified · source: NVD
TE
Te50 · Huawei
All versions, or not specified · source: NVD
TE
Te60 · Huawei
All versions, or not specified · source: NVD
TF
Te60 Firmware · Huawei
through v100r001c10b022 · source: NVD