The outdoor unit of Customer Premise Equipment (CPE) product B2338-168 V100R001C00 has a no authentication vulnerability on the serial port.

Published 8 y ago 2017-11-22 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

0.3%

percentile 22%

Public exploits

none known

The outdoor unit of Customer Premise Equipment (CPE) product B2338-168 V100R001C00 has a no authentication vulnerability on the serial port. An attacker can access the serial port on the circuit board of the outdoor unit and log in to the CPE without authentication. Successful exploit could allow the attacker to take control over the outdoor unit.

Exploit prediction (EPSS)

0.29% probability of exploitation in the next 30 days, higher than 22% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	6.8	`CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	7.2	`AV:L/AC:L/Au:N/C:C/I:C/A:C`

Affected products

Huawei Technologies Co., Ltd. B2338-168

Classification

Weakness

CWE-306 Missing Authentication for Critical Functionality

References

huawei.com /en/psirt/security-advisories/2017/huawei-sa-20170920-01-cpe-en · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2017-8156
NVD: CVE-2017-8156

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.