CVE Vulnerabilities

CVE-2015-7843

Published: Oct 03, 2017 | Modified: Oct 23, 2017
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
4 MEDIUM
AV:N/AC:L/Au:S/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu

The management interface on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 does not limit the number of query attempts, which allows remote authenticated users to obtain credentials of higher-level users via a brute force attack.

Affected Software

Name Vendor Start Version End Version
Fusionserver_ch121_v3 Huawei v100r001c00 (including) v100r001c00 (including)
Fusionserver_ch220_v3 Huawei v100r001c00 (including) v100r001c00 (including)
Fusionserver_ch222_v3 Huawei v100r001c00 (including) v100r001c00 (including)
Fusionserver_rh1288_v3 Huawei v100r003c00spc100 (including) v100r003c00spc100 (including)
Fusionserver_rh1288a_v2 Huawei v100r002c00 (including) v100r002c00 (including)
Fusionserver_rh2288_v3 Huawei v100r003c00 (including) v100r003c00 (including)
Fusionserver_rh2288a_v2 Huawei v100r002c00 (including) v100r002c00 (including)
Fusionserver_rh2288h_v3 Huawei v100r003c00 (including) v100r003c00 (including)
Fusionserver_rh8100_v3 Huawei v100r003c00 (including) v100r003c00 (including)
Fusionserver_xh628_v3 Huawei v100r003c00 (including) v100r003c00 (including)

References