Threat Investigation
Request a demo

CVE-2017-2738

Critical

Description

VCM5010 with software versions earlier before V100R002C50SPC100 has an authentication bypass vulnerability. This is due to improper implementation of authentication for accessing web pages. An unauthenticated attacker could bypass the authentication by sending a crafted HTTP request. 5010 with software versions earlier before V100R002C50SPC100 has an arbitrary file upload vulnerability. The software does not validate the files that uploaded. An authenticated attacker could upload arbitrary files to the system.

SeverityCritical
CVSS9.8
Exploit probability—
ProductHuawei Vcm5010 Firmware
PublishedNov 22, 2017
First seenNov 22, 2017

How to fix

Update
  • huawei vcm5010_firmwarev100r002c50spc100 or later

Affected products

ProductAffected versionsFixed in
huawei vcm5010_firmwarev < v100r002c50spc100v100r002c50spc100

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.