CVE-2022-33735: huawei-sa-20220628-01-2eda0853-en

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy

Back to Main Menu

Huawei Websites

Corporate

Corporate news and information

Consumer

Phones, laptops, tablets, wearables & other devices

Enterprise

Enterprise products, solutions & services

Carrier

Products, solutions & services for carrier networks

Huawei Cloud

Cloud products, solutions & services

Security Advisory - Password Verification Vulnerability of Huawei Router

• SA No:huawei-sa-20220628-01-2eda0853
• Initial Release Date: Jun 28, 2022
• Last Release Date: Jun 28, 2022

There is a password verification vulnerability in WS7200-10.Attackers on the LAN may use brute force cracking to obtain passwords, which may cause sensitive system information to be disclosed. (Vulnerability ID: HWPSIRT-2022-16010)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2022-33735.

For products that have released software updates to fix this vulnerability, Huawei will release and update the Security Advisory at:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220628-01-2eda0853-en

Product Name

Affected Version

Resolved Product and Version

WS7200-10

11.0.2.13

2.1.0.202

Attackers may use brute force cracking to obtain passwords, which may cause sensitive system information to be disclosed.

This vulnerability can be exploited only when the following conditions are present:

Available on LAN only.

Vulnerability details:

There is a password verification vulnerability in WS7200-10.Attackers on the LAN may bypass the anti-brute-force-cracking mechanism and obtain passwords through brute force cracking, which may cause sensitive system information to be disclosed.

The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.

Vulnerability information provided by Linfeng Xiao (@migraine-sudo) and Lingjuan Tang. Thanks to Linfeng Xiao (@migraine-sudo) and Lingjuan Tang for their attention to Huawei product vulnerabilities!

Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.

To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.

To report a security vulnerability in Huawei products and solutions, please send it to [email protected]. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.

This document is provided on an “AS IS” basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.