Low severity · published Feb 15, 2018
CVE-2017-15352
Huawei OceanStor 2800 V3, V300R003C00, V300R003C20, OceanStor 5300 V3, V300R003C00, V300R003C10, V300R003C20, OceanStor 5500 V3, V300R003C00, V300R003C10, V300R003C20, OceanStor…
3.1
CVSS
0.3%
EPSS
No
On KEV
Description
Huawei OceanStor 2800 V3, V300R003C00, V300R003C20, OceanStor 5300 V3, V300R003C00, V300R003C10, V300R003C20, OceanStor 5500 V3, V300R003C00, V300R003C10, V300R003C20, OceanStor 5600 V3, V300R003C00, V300R003C10, V300R003C20, OceanStor 5800 V3, V300R003C00, V300R003C10, V300R003C20 have an improper access control vulnerability. Due to incorrectly restrict access to a resource, an attacker with high privilege may exploit the vulnerability to query some information or send specific message to cause some service abnormal.
CVSS vector
CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L
Attack vector
Adjacent
Complexity
High
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
O2
Oceanstor 2800 Firmware · Huawei
v300r003c00; v300r003c20 · source: NVD
O5
Oceanstor 5300 Firmware · Huawei
v300r003c00; v300r003c10; v300r003c20 · source: NVD
O5
Oceanstor 5500 Firmware · Huawei
v300r003c00; v300r003c10; v300r003c20 · source: NVD
O5
Oceanstor 5600 Firmware · Huawei
v300r003c00; v300r003c10; v300r003c20 · source: NVD
O5
Oceanstor 5800 Firmware · Huawei
v300r003c00; v300r003c10; v300r003c20 · source: NVD