Login Request a demo
High severity · published May 24, 2018
CVE-2018-7942
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have an authentication bypass vulnerability
7.5
CVSS
1.6%
EPSS
No
On KEV
Description
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have an authentication bypass vulnerability. An unauthenticated, remote attacker may send some specially crafted messages to the affected products. Due to improper authentication design, successful exploit may cause some information leak.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
1V
1288h V5 Firmware · Huawei
100r005c00 · source: NVD
2V
2288h V5 Firmware · Huawei
100r005c00 · source: NVD
2V
2488 V5 Firmware · Huawei
100r005c00 · source: NVD
CV
Ch121 V3 Firmware · Huawei
100r001c00 · source: NVD
CV
Ch121l V3 Firmware · Huawei
100r001c00 · source: NVD
CV
Ch121l V5 Firmware · Huawei
100r001c00 · source: NVD
CV
Ch242 V3 Firmware · Huawei
100r001c00 · source: NVD
Affected product
1V
1288h V5 Firmware
Huawei
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7942
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7942
Broken Link
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180523-01-server-en
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/143686
More from 1288h V5 Firmware
8.8
CVE-2018-7943
There is an authentication bypass vulnerability in some Huawei servers
8.8
CVE-2018-7951
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation
8.8
CVE-2018-7950
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation
8.8
CVE-2018-7949
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability
8.8
CVE-2018-7904
Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability