CVE-2016-8754 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

Huawei OceanStor 5600 V3 V300R003C00 has a hardcoded SSH key vulnerability; the hardcoded keys are used to encrypt communication data and authenticate different nodes of the devices. An attacker may obtain the hardcoded keys and log in to such a device through SSH.

CVSS Score

7.5

HIGH

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

ADJACENT_NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Huawei	Oceanstor 5600 V3 Firmware	v300r003c00
Huawei	Oceanstor 5600 V3	-

Related Weaknesses (CWE)

CWE-798

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161017-01-storageVendor Advisory
http://www.securityfocus.com/bid/93607Third Party AdvisoryVDB Entry
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161017-01-storageVendor Advisory
http://www.securityfocus.com/bid/93607Third Party AdvisoryVDB Entry

FAQ

What is CVE-2016-8754?

CVE-2016-8754 is a vulnerability with a CVSS score of 7.5 (HIGH). Huawei OceanStor 5600 V3 V300R003C00 has a hardcoded SSH key vulnerability; the hardcoded keys are used to encrypt communication data and authenticate different nodes of the devices. An attacker may o...

How severe is CVE-2016-8754?

CVE-2016-8754 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2016-8754?

Check the references section above for vendor advisories and patch information. Affected products include: Huawei Oceanstor 5600 V3 Firmware, Huawei Oceanstor 5600 V3.