8.8high
CVE-2018-7941
Huawei iBMC V200R002C60 have an authentication bypass vulnerability.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.8%
percentile 55%
Public exploits
0
none known
Summary
Huawei iBMC V200R002C60 have an authentication bypass vulnerability. A remote attacker with low privilege may craft specific messages to upload authentication certificate to the affected products. Due to improper validation of the upload authority, successful exploit may cause privilege elevation.
Exploit prediction (EPSS)
0.75% probability of exploitation in the next 30 days, higher than 55% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- Huawei Technologies Co., Ltd. iBMC
Classification
- Weakness
- CWE-287 Improper Authentication
References
- huawei.com /en/psirt/security-advisories/huawei-sa-20180509-01-bypass-en · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-7941
- NVD: CVE-2018-7941
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.