CVE-2016-6670 — MEDIUM (5.3)

Vulnerability Description

Huawei S7700, S9300, S9700, and S12700 devices with software before V200R008C00SPC500 use random numbers with insufficient entropy to generate self-signed certificates, which makes it easier for remote attackers to discover private keys by leveraging knowledge of a certificate.

CVSS Score

5.3

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Huawei Firmware	S12700	v200r005c00
Huawei	S12700	-
Huawei	S9700 Firmware	v200r003c00
Huawei	S9700	-
Huawei	S7700 Firmware	v200r003c00
Huawei	S7700	-
Huawei	S9300 Firmware	v200r003c00
Huawei	S9300	-

Related Weaknesses (CWE)

CWE-200

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160810-01-certifiMitigationVendor Advisory
http://www.securityfocus.com/bid/92438Third Party AdvisoryVDB Entry
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160810-01-certifiMitigationVendor Advisory
http://www.securityfocus.com/bid/92438Third Party AdvisoryVDB Entry

FAQ

What is CVE-2016-6670?

CVE-2016-6670 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Huawei S7700, S9300, S9700, and S12700 devices with software before V200R008C00SPC500 use random numbers with insufficient entropy to generate self-signed certificates, which makes it easier for remot...

How severe is CVE-2016-6670?

CVE-2016-6670 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2016-6670?

Check the references section above for vendor advisories and patch information. Affected products include: Huawei Firmware S12700, Huawei S12700, Huawei S9700 Firmware, Huawei S9700, Huawei S7700 Firmware.