Medium severity · published Nov 22, 2017
CVE-2017-8157
OceanStor 5800 V3 with software V300R002C00 and V300R002C10, OceanStor 6900 V3 V300R001C00 has an information leakage vulnerability
5.9
CVSS
0.6%
EPSS
No
On KEV
Description
OceanStor 5800 V3 with software V300R002C00 and V300R002C10, OceanStor 6900 V3 V300R001C00 has an information leakage vulnerability. Products use TLS1.0 to encrypt. Attackers can exploit TLS1.0's vulnerabilities to decrypt data to obtain sensitive information.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
O5
Oceanstor 5800 V3 Firmware · Huawei
v300r002c00; v300r002c10 · source: NVD
O6
Oceanstor 6900 V3 Firmware · Huawei
v300r001c00 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-8157
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-8157
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170920-01-oceanstor-en
More from Oceanstor 5800 V3 Firmware
8.1
CVE-2016-3081
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method:…
6.5
CVE-2016-6177
The Huawei OceanStor 5800 V300R003C00 has an integer overflow vulnerability