Login Request a demo
High severity · published Jun 1, 2018
CVE-2018-7949
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specially crafted login messages to the affected products. Due to improper authentication design, successful exploit enables low privileged users to get or modify passwords of highly privileged users.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
1V
1288h V5 Firmware · Huawei
100r005c00 · source: NVD
2V
2288h V5 Firmware · Huawei
100r005c00 · source: NVD
2V
2488 V5 Firmware · Huawei
100r005c00 · source: NVD
CV
Ch121 V3 Firmware · Huawei
100r001c00 · source: NVD
CV
Ch121 V5 Firmware · Huawei
100r001c00 · source: NVD
CV
Ch121l V3 Firmware · Huawei
100r001c00 · source: NVD
CV
Ch121l V5 Firmware · Huawei
100r001c00 · source: NVD
CV
Ch140 V3 Firmware · Huawei
100r001c00 · source: NVD
CV
Ch140l V3 Firmware · Huawei
100r001c00 · source: NVD
CV
Ch220 V3 Firmware · Huawei
100r001c00 · source: NVD
CV
Ch222 V3 Firmware · Huawei
100r001c00 · source: NVD
CV
Ch242 V3 Firmware · Huawei
100r001c00 · source: NVD
Affected product
1V
1288h V5 Firmware
Huawei
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7949
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7949
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180530-03-server-en
More from 1288h V5 Firmware
8.8
CVE-2018-7943
There is an authentication bypass vulnerability in some Huawei servers
8.8
CVE-2018-7951
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation
8.8
CVE-2018-7950
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation
8.8
CVE-2018-7904
Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability
8.8
CVE-2018-7903
Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability