CVE-2017-15328 - OpenCVE

Huawei HG8245H version earlier than V300R018C00SPC110 has an authentication bypass vulnerability. An attacker can access a specific URL of the affect product. Due to improper verification of the privilege, successful exploitation may cause information leak.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Huawei	Hg8245h Hg8245h Firmware

Configuration 1 [-]

AND

cpe:2.3:o:huawei:hg8245h_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:huawei:hg8245h:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://support.huawei.com/carrier/docview%21docview?nid=DOC1000441394&path=PBI1-7275726/PBI1-7275742/PBI1-7912539/PBI1-22318696/PBI1-8952133/PBI1-8957546/PBI1-22412232/PBI1-22412234/PBI1-22807623
https://hacked0x90.wordpress.com/2017/11/30/hg8245h-authentication-bypass/

History

No history.

MITRE

Status: PUBLISHED

Assigner: huawei

Published: 2017-12-22T17:00:00

Updated: 2024-08-05T19:50:16.494Z

Reserved: 2017-10-14T00:00:00

Link: CVE-2017-15328

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-12-22T17:29:13.500

Modified: 2023-11-07T02:39:34.137

Link: CVE-2017-15328

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "HG8245H", "vendor": "Huawei Technologies Co., Ltd.", "versions": [{"status": "affected", "version": "Earlier than EchoLife HG8245H V300R018C00SPC110"}]}], "datePublic": "2017-12-06T00:00:00", "descriptions": [{"lang": "en", "value": "Huawei HG8245H version earlier than V300R018C00SPC110 has an authentication bypass vulnerability. An attacker can access a specific URL of the affect product. Due to improper verification of the privilege, successful exploitation may cause information leak."}], "problemTypes": [{"descriptions": [{"description": "authentication bypass", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-12-22T19:57:01", "orgId": "25ac1063-e409-4190-8079-24548c77ea2e", "shortName": "huawei"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://support.huawei.com/carrier/docview%21docview?nid=DOC1000441394&path=PBI1-7275726/PBI1-7275742/PBI1-7912539/PBI1-22318696/PBI1-8952133/PBI1-8957546/PBI1-22412232/PBI1-22412234/PBI1-22807623"}, {"tags": ["x_refsource_MISC"], "url": "https://hacked0x90.wordpress.com/2017/11/30/hg8245h-authentication-bypass/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@huawei.com", "ID": "CVE-2017-15328", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "HG8245H", "version": {"version_data": [{"version_value": "Earlier than EchoLife HG8245H V300R018C00SPC110"}]}}]}, "vendor_name": "Huawei Technologies Co., Ltd."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Huawei HG8245H version earlier than V300R018C00SPC110 has an authentication bypass vulnerability. An attacker can access a specific URL of the affect product. Due to improper verification of the privilege, successful exploitation may cause information leak."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "authentication bypass"}]}]}, "references": {"reference_data": [{"name": "http://support.huawei.com/carrier/docview!docview?nid=DOC1000441394&path=PBI1-7275726/PBI1-7275742/PBI1-7912539/PBI1-22318696/PBI1-8952133/PBI1-8957546/PBI1-22412232/PBI1-22412234/PBI1-22807623", "refsource": "MISC", "url": "http://support.huawei.com/carrier/docview!docview?nid=DOC1000441394&path=PBI1-7275726/PBI1-7275742/PBI1-7912539/PBI1-22318696/PBI1-8952133/PBI1-8957546/PBI1-22412232/PBI1-22412234/PBI1-22807623"}, {"name": "https://hacked0x90.wordpress.com/2017/11/30/hg8245h-authentication-bypass/", "refsource": "MISC", "url": "https://hacked0x90.wordpress.com/2017/11/30/hg8245h-authentication-bypass/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T19:50:16.494Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://support.huawei.com/carrier/docview%21docview?nid=DOC1000441394&path=PBI1-7275726/PBI1-7275742/PBI1-7912539/PBI1-22318696/PBI1-8952133/PBI1-8957546/PBI1-22412232/PBI1-22412234/PBI1-22807623"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://hacked0x90.wordpress.com/2017/11/30/hg8245h-authentication-bypass/"}]}]}, "cveMetadata": {"assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e", "assignerShortName": "huawei", "cveId": "CVE-2017-15328", "datePublished": "2017-12-22T17:00:00", "dateReserved": "2017-10-14T00:00:00", "dateUpdated": "2024-08-05T19:50:16.494Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:hg8245h_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD6C81D0-8C6B-4BBE-BE29-A0B45E767E30", "versionEndExcluding": "v300r018c00spc110", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:huawei:hg8245h:-:*:*:*:*:*:*:*", "matchCriteriaId": "CC7D61F0-543D-4087-A112-FDA4DDEC0C20", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Huawei HG8245H version earlier than V300R018C00SPC110 has an authentication bypass vulnerability. An attacker can access a specific URL of the affect product. Due to improper verification of the privilege, successful exploitation may cause information leak."}, {"lang": "es", "value": "Huawei HG8245H en versiones anteriores a la V300R018C00SPC110 contiene una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n. Un atacante puede acceder a un URL espec\u00edfica del producto afectado. Debido a una verificaci\u00f3n incorrecta de los privilegios, una explotaci\u00f3n exitosa podr\u00eda dar lugar a una fuga de informaci\u00f3n."}], "id": "CVE-2017-15328", "lastModified": "2023-11-07T02:39:34.137", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-12-22T17:29:13.500", "references": [{"source": "psirt@huawei.com", "url": "http://support.huawei.com/carrier/docview%21docview?nid=DOC1000441394&path=PBI1-7275726/PBI1-7275742/PBI1-7912539/PBI1-22318696/PBI1-8952133/PBI1-8957546/PBI1-22412232/PBI1-22412234/PBI1-22807623"}, {"source": "psirt@huawei.com", "tags": ["Third Party Advisory"], "url": "https://hacked0x90.wordpress.com/2017/11/30/hg8245h-authentication-bypass/"}], "sourceIdentifier": "psirt@huawei.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}