Vulnerability Description
VCM5010 with software versions earlier before V100R002C50SPC100 has an authentication bypass vulnerability. This is due to improper implementation of authentication for accessing web pages. An unauthenticated attacker could bypass the authentication by sending a crafted HTTP request. 5010 with software versions earlier before V100R002C50SPC100 has an arbitrary file upload vulnerability. The software does not validate the files that uploaded. An authenticated attacker could upload arbitrary files to the system.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Huawei | Vcm5010 Firmware | < v100r002c50spc100 |
| Huawei | Vcm5010 | - |
Related Weaknesses (CWE)
References
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170329-01-vcm-enVendor Advisory
- http://www.securityfocus.com/bid/97231Third Party AdvisoryVDB Entry
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170329-01-vcm-enVendor Advisory
- http://www.securityfocus.com/bid/97231Third Party AdvisoryVDB Entry
FAQ
What is CVE-2017-2738?
CVE-2017-2738 is a vulnerability with a CVSS score of 9.8 (CRITICAL). VCM5010 with software versions earlier before V100R002C50SPC100 has an authentication bypass vulnerability. This is due to improper implementation of authentication for accessing web pages. An unauthe...
How severe is CVE-2017-2738?
CVE-2017-2738 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2017-2738?
Check the references section above for vendor advisories and patch information. Affected products include: Huawei Vcm5010 Firmware, Huawei Vcm5010.