CVE-2014-5395

Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users for requests that (1) modify configurations, (2) send SMS messages, or have other unspecified impact via unknown vectors.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/69162
http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-360246.htm	Vendor Advisory
https://www.exploit-db.com/exploits/46092/

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:o:huawei:e5180s-22_firmware:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:huawei:e3276_firmware:*:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:huawei:e3276_firmware:*:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:o:huawei:e3236_firmware:*:*:*:*:*:*:*:*

Configuration 5 (hide)

cpe:2.3:o:huawei:e586bs-2_firmware:*:*:*:*:*:*:*:*

Configuration 6 (hide)

cpe:2.3:o:huawei:e3236_firmware:*:*:*:*:*:*:*:*

Information

Published : 2014-11-21 07:59

Updated : 2019-01-08 03:29

NVD link : CVE-2014-5395

Mitre link : CVE-2014-5395

JSON object : View

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

Advertisement

Products Affected

huawei

e5180s-22_firmware
e3276_firmware
e586bs-2_firmware
e3236_firmware

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/69162", "name": "69162", "tags": [], "refsource": "BID"}, {"url": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-360246.htm", "name": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-360246.htm", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://www.exploit-db.com/exploits/46092/", "name": "46092", "tags": [], "refsource": "EXPLOIT-DB"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users for requests that (1) modify configurations, (2) send SMS messages, or have other unspecified impact via unknown vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-352"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-5395", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2014-11-21T15:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:huawei:e5180s-22_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "e5180s-22tcpu-21.270.05.01.00"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:huawei:e3276_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "webui-13.100.09.00.03"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:huawei:e3276_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "e3276s-150tcpu-22.265.03.00.00"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:huawei:e3236_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "webui-13.100.10.00.03"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:huawei:e586bs-2_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "e586bs-2tcpu-21.322.08.00.889"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:huawei:e3236_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "e3236s-2tcpu-22.146.29.00.00"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2019-01-08T11:29Z"}