CVE-2018-7958 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2018-7958

Analyzed

More Info Official Page

Source-psirt@huawei.com

Published At-27 Nov, 2018 | 22:29

Updated At-20 Dec, 2018 | 18:02

There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to hijack the connection from a client when the user signs up to log in by TLS. Due to insufficient authentication, which may be exploited to intercept and tamper with the data information.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	7.4	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary	2.0	5.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:N

Type: Primary

Version: 3.0

Base score: 7.4

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Type: Primary

Version: 2.0

Base score: 5.8

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:P/A:N

CPE Matches

Huawei Technologies Co., Ltd.

>>espace_7950_firmware>>v200r003c30

cpe:2.3:o:huawei:espace_7950_firmware:v200r003c30:*:*:*:*:*:*:*

Huawei Technologies Co., Ltd.

>>espace_7950>>-

cpe:2.3:h:huawei:espace_7950:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-287	Primary	nvd@nist.gov

CWE ID: CWE-287

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181114-01-espace-en	psirt@huawei.com	Vendor Advisory

Hyperlink: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181114-01-espace-en

Source: psirt@huawei.com

Resource:

Vendor Advisory