The laser command injection vulnerability exists on AIS-BW80H-00 versions earlier than AIS-BW80H-00 9.0.3.4(H100SP13C00). The devices cannot effectively defend against external malicious interference. Attackers need the device to be visually exploitable and successful triggering of this vulnerability could execute voice commands on the device.

The laser command injection vulnerability exists on some Huawei devices. The devices cannot effectively defend against external malicious interference. Attackers need the device to be visually exploitable and successful triggering of this vulnerability could execute voice commands on the device. (Vulnerability ID: HWPSIRT-2021-60677)  
This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2021-40043.  
For products that have released software updates to fix this vulnerability, Huawei will release and update the Security Advisory at:  
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220126-01-df75863e-en  

Product Name

Affected Version

Resolved Product and Version

AIS-BW80H-00

versions earlier than AIS-BW80H-00 9.0.3.4(H100SP13C00)

9.0.3.4(H100SP17C00)

  

Successful triggering of this vulnerability could allow voice commands to be executed on the device.  

This vulnerability can be exploited only when the following conditions are present:  
The attacked device must be within the visual distance of the attacker.  
Vulnerability details:  
The device does not effectively defend against malicious interference from the outside. Attackers need the device to be visually exploitable and successful triggering of this vulnerability could execute voice commands on the device.  

The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.  

The vulnerability was discovered by external researchers.

  

Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.

To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.

To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.

CVE-2021-40043: Security Advisory - Laser Command Injection Vulnerability on Huawei Terminals

There is an identity authentication bypass vulnerability in Huawei Children Smart Watch (Simba-AL00) 1.1.1.274. Successful exploitation of this vulnerability may cause the access control function of specific applications to fail.

The Huawei Children Smart Watch (Simba-AL00) has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may cause the access control function of specific applications to fail.(Vulnerability ID:HWPSIRT-2022-18770)  
This vulnerability has been assigned a (CVE) ID: CVE-2022-48305

Affected Product

Affected Version

Repair Versions

Simba-AL00

Simba-AL00 1.1.1.274

Simba-AL00 1.1.1.302

  

HWPSIRT-2022-18770:  
Successful exploitation of this vulnerability may cause the access control function of specific applications to fail.

Vulnerabilities are scored base on the CVSS v3.1 scoring system. For details please refer to: http://www.first.org/cvss/specification-document.   
HWPSIRT-2022-18770   
Base Score: 6.2   
Temporary Score: 5.8   
Environmental Score: NA   
CVSS v3.1 Vector: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C

HWPSIRT-2022-18770:   
This vulnerability can be exploited only when the following conditions are present:    
Attackers need to construct malicious voice commands.   
Technical details:    
The Huawei Children Smart Watch (Simba-AL00) has an identity authentication bypass vulnerability. Attackers can construct malicious voice commands to open specific applications. Successful exploitation of this vulnerability may cause the access control function of specific applications to fail.

The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.

HWPSIRT-2022-18770:   
The vulnerability was discovered by an external researcher.

2023-02-08 V1.0 Initial Release;

Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.

To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.

To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.

CVE-2022-48305: Security Advisory - Identity Authentication Bypass Vulnerability in The Huawei Children Smart Watch (Simba-AL00)

A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnerability could allow attackers to access restricted functions.

A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnerability could allow attackers to access restricted functions. (Vulnerability ID:HWPSIRT-2022-90086)

This vulnerability has been assigned a (CVE) ID: CVE-2022-48284

  

Affected Product

Affected Version

Repair Version

HarmonyOS AILife Solution 6.0

HiLink AI Life 12.0.2.305

HiLink AI Life 12.0.3.305

HWPSIRT-2022-90086:

Successful exploitation could allow attackers to access restricted functions.

  

Vulnerabilities are scored base on the CVSS v3.1 scoring system. For details please refer to: http://www.first.org/cvss/specification-document.

HWPSIRT-2022-90086

Base Score: 4.5

Temporary Score: 4.2

Environmental Score: NA

CVSS v3.1 Vector: AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C

  

HWPSIRT-2022-90086:

This vulnerability can be exploited only when the following conditions are present:

Attackers construct malicious applications.

Technical details:

A piece of Huawei whole-home intelligence software does not correctly verify the caller's permission. As a result, an Incorrect Privilege Assignment vulnerability is caused. An attacker can construct a malicious application to exploit this vulnerability and access restricted functions.

  

The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.  

The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.  

2023-02-01 V1.0 Initial Release

  

Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.

To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.

To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.

CVE-2022-48284: Security Advisory - Incorrect Privilege Assignment Vulnerability in Huawei Whole-Home Intelligence Software

*   SA No:huawei-sa-IPAViHWHIS-1afe7781
*   Initial Release Date: 2023-02-01
*   Last Release Date: 2023-02-01

  

A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnerability could allow attackers to access restricted functions.(Vulnerability ID:HWPSIRT-2022-52968)

This vulnerability has been assigned a (CVE) ID: CVE-2022-48283

Affected Product

Affected Version

Repair Versions

HarmonyOS AILife Solution 6.0

HiLink AI Life 12.0.2.305

HiLink AI Life 12.0.3.305

  

HWPSIRT-2022-52968:

Successful exploitation could allow attackers to access restricted functions.

  

Vulnerabilities are scored base on the CVSS v3.1 scoring system. For details please refer to: http://www.first.org/cvss/specification-document.

HWPSIRT-2022-52968

Base Score: 7.0

Temporary Score: 6.5

Environmental Score: NA

CVSS v3.1 Vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

  

HWPSIRT-2022-52968:

This vulnerability can be exploited only when the following conditions are present:

Attackers construct malicious applications.

Technical details:

A piece of Huawei whole-home intelligence software does not correctly verify the caller's permission. As a result, an Incorrect Privilege Assignment vulnerability is caused. An attacker can construct a malicious application to exploit this vulnerability and access restricted functions.

  

The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.

HWPSIRT-2022-52968:

This vulnerability was discovered by Huawei internal tester.

  

2023-02-01 V1.0 Initial Release

  

Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.

To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.

To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.

CVE-2022-48283: Security Advisory - Incorrect Privilege Assignment Vulnerability in Huawei Whole-Home Intelligence Software

There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution.

*   SA No:huawei-sa-SCIViaHPP-f18e962a
*   Initial Release Date: 2023-01-18
*   Last Release Date: 2023-01-18

  

A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution.(Vulnerability ID:HWPSIRT-2022-90114)

This vulnerability has been assigned a (CVE)ID:CVE-2022-48255

  

Affected Product

Affected Version

Repair Version

BiSheng-WNM

BiSheng-WNM FW 3.0.0.325

BiSheng-WNM FW 3.0.0.327

  

HWPSIRT-2022-90114:

Successful exploitation could lead to remote code execution.

  

Vulnerabilities are scored base on the CVSS v3.1 scoring system. For details please refer to: http://www.first.org/cvss/specification-document.

HWPSIRT-2022-90114

Base Score: 9.8

Temporary Score: 9.1

Environmental Score: NA

CVSS v3.1 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

  

HWPSIRT-2022-90114:

This vulnerability can be exploited only when the following conditions are present:

An attacker can access devices through the network.

Technical details:

A Huawei printer product has a system command injection vulnerability. This vulnerability is caused by improper filtering of special characters in external input. Unauthorized attackers can exploit this vulnerability by constructing malicious external input. Successful exploitation could lead to remote code execution.

  

The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.  

HWPSIRT-2022-90114:

This vulnerability was discovered by Huawei internal tester.

  

2023-01-18 V1.0 Initial Release

  

Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.

To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.

To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.

CVE-2022-48255: Security Advisory - System Command Injection Vulnerability in a Huawei Printer Product

There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation of this vulnerability may cause the printer service to be abnormal.

There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.(Vulnerability ID:HWPSIRT-2022-78037)  
This vulnerability has been assigned a (CVE) ID: CVE-2022-48261

Affected Product

Affected Version

Repair Versions

BiSheng-WNM

BiSheng-WNM FW 3.0.0.325

BiSheng-WNM FW 3.0.0.327

  

HWPSIRT-2022-78037:  
Successful exploitation of this vulnerability may cause the printer service to be abnormal.

Vulnerabilities are scored base on the CVSS v3.1 scoring system. For details please refer to: http://www.first.org/cvss/specification-document.   
HWPSIRT-2022-78037  
Base Score: 7.5  
Temporary Score: 7.0  
Environmental Score: NA  
CVSS v3.1 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C

HWPSIRT-2022-78037:  
This vulnerability can be exploited only when the following conditions are present:  
An attacker can send a specially crafted packet to the affected device.   
Technical details:   
The packet parsing module of a port on a Huawei printer has a misinterpretation of input vulnerability. The vulnerability is caused by insufficient verification of external input packets. Attackers can exploit this vulnerability by constructing malicious packets. Successful exploitation could lead to printer device service exceptions, etc.

The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.

HWPSIRT-2022-78037:  
This vulnerability was discovered by Huawei internal tester.  

2023-01-18 V1.0 Initial Release;

Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.

To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.

To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.

CVE-2022-48261: Security Advisory - Misinterpretation of Input Vulnerability in Huawei Printer

There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could allow attackers to gain higher privileges.

A Huawei printer has a system command injection vulnerability. Successful exploitation could allow attackers to gain higher privileges. (Vulnerability ID:HWPSIRT-2022-87340)   
This vulnerability has been assigned a (CVE) ID: CVE-2022-48259

Affected Product

Affected Version

Resolved Versions

BiSheng-WNM

BiSheng-WNM FW 3.0.0.325

BiSheng-WNM FW 3.0.0.327

HWPSIRT-2022-87340:  
Successful exploitation could allow attackers to gain higher privileges.

Vulnerabilities are scored base on the CVSS v3.1 scoring system. For details please refer to: http://www.first.org/cvss/specification-document.

HWPSIRT-2022-87340:  
Base score:9.8  
Temporary score:9.1  
Environmental Score:NA  
CVSS v3.1 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

HWPSIRT-2022-87340:  
This vulnerability can be exploited only when the following conditions are present:   
Attackers can gain access to the affected target devices.  
Technical details:  
A Huawei printer product has a system command injection vulnerability. An attacker can exploit this vulnerability by sending a specially crafted packet to a specific port of the target device. Successful exploitation could allow the attacker to gain higher privileges.

The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.

The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.

HWPSIRT-2022-87340:

This vulnerability was discovered by Huawei internal tester.

2023-01-18 V1.0 Initial Release;

Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.

To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.

To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.

CVE-2022-48259: Security Advisory - System Command Injection Vulnerability in a Huawei Printer Product

Huawei Aslan Children's Watch has a path traversal vulnerability. Successful exploitation may allow attackers to access or modify protected system resources.

Huawei Aslan Children's Watch has a path traversal vulnerability. Successful exploitation may allow attackers to access or modify protected system resources. (Vulnerability ID:HWPSIRT-2022-99716)

This vulnerability has been assigned a (CVE) ID: CVE-2022-44564

**Affected Product**

**Affected Version**

**Resolved Versions**

Aslan-AL10

Aslan-AL10-OTA 11.1.0.118(C00M06)-11.1.0.10118(C00M06)

Aslan-AL10-OTA 11.1.0.135(C00M08log)-11.1.0.10135(C00M08log)

Aslan-AL10

Aslan-AL10-OTA 11.1.0.118(C00M06)-11.1.0.10118(C00M06)

Aslan-AL10-OTA 11.1.0.135(C00M08log)-11.1.0.10135(C00M08log)

Aslan-AL10

Aslan-AL10-OTA 11.1.0.118(C00M06)-11.1.0.10118(C00M06)

Aslan-AL10-OTA 11.1.0.135(C00M08log)-11.1.0.10135(C00M08log)

HWPSIRT-2022-99716:

Successful exploitation could result in an attacker accessing or modifying protected system resources.

HWPSIRT-2022-99716:

Base score:8.4

Temporary score:7.8

Environmental Score:NA

CVSS v3.1 Vector: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

HWPSIRT-2022-99716:

This vulnerability can be exploited only when the following conditions are present:

Attackers need to be able to install apps on devices.

Technical details:

Huawei Aslan Children's Watch does not properly verify the path transmitted in external input, leading to a path traversal vulnerability. An attacker who can install an app on the device can exploit this vulnerability by installing a malicious application. Successful exploitation may cause the attacker to access or modify protected system resources.

HWPSIRT-2022-99716:

This vulnerability was discovered by Huawei internal tester.

2022-11-02 V1.0 Initial Release;  

Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.

To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.

To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.

CVE-2022-44564: Security Advisory - Path Traversal Vulnerability in a Huawei Children's Watch

There is a denial of service vulnerability in the Wi-Fi module of the HUAWEI WS7100-20 Smart WiFi Router.Successful exploit could cause a denial of service (DoS) condition.

There is a denial of service vulnerability in the Wi-Fi module of the HUAWEI WS7100-20 Smart WiFi Router.Successful exploit could cause a denial of service (DoS) condition. (Vulnerability ID:HWPSIRT-2022-59488)

This vulnerability has been assigned a (CVE) ID: CVE-2022-46740

Affected Product

Affected Version

Resolved Version

WS7100-20

WS7100-20 10.0.5.33

WS7100-20 11.0.5.5

Successful exploit could cause a denial of service (DoS) condition.

HWPSIRT-2022-59488:

Base score:4.3

Temporary score:4.0

Environmental Score:NA

CVSS v3.1 Vector: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F/RL:O/RC:C

HWPSIRT-2022-59488:

This vulnerability can be exploited only when the following conditions are present:

An attacker could send a crafted message to the device.

Technical details:

There is a denial of service vulnerability in the Wi-Fi module of the HUAWEI WS7100-20 Smart WiFi Router. Due to incorrect verification of external messages, An attacker can exploit this vulnerability by sending crafted packets to the device.Successful exploitation of this vulnerability may cause a denial of service vulnerability on the WS7100-20.

The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.

The vulnerability was discovered by external researchers Vyron Kampourakis and Efstratios Chatzoglou.

2022-12-09 V1.1 Updated "Source";  
2022-12-08 V1.0 Initial Release;

Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.

To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.

To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.

CVE-2022-46740: huawei-sa-DoSViHSWR-8f632df1-en

There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.

There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal. (Vulnerability ID:HWPSIRT-2022-47904)

This vulnerability has been assigned a (CVE) ID: CVE-2022-48471

Affected Product

Affected Version

Repair Versions

BiSheng-WNM

BiSheng-WNM FW 3.0.0.325

BiSheng-WNM FW 3.0.0.327

Successful exploitation of this vulnerability may cause the printer service to be abnormal.  

Vulnerabilities are scored base on the CVSS v3.1 scoring system. For details please refer to: https://www.first.org/cvss/specification-document.

HWPSIRT-2022-47904

Base Score: 7.5

Temporal Score: 7.0

Environmental Score: NA

CVSS v3.1 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C

  

HWPSIRT-2022-47904:

This vulnerability can be exploited only when the following conditions are present:

An attacker can send a specially crafted packet to the affected device.

Technical details:

The packet parsing module of a port on a Huawei printer has a misinterpretation of input vulnerability. The vulnerability is caused by insufficient verification of external input packets. Attackers can exploit this vulnerability by constructing malicious packets. Successful exploitation could lead to printer device service exceptions, etc.

  

The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.  

HWPSIRT-2022-47904:

This vulnerability was discovered by Huawei internal tester.

  

2023-04-26 V1.0 Initial Release

Huawei adheres to protecting the ultimate interests of users with best efforts and the principle of responsible disclosure and deal with product security issues through our response mechanism.

To enjoy Huawei PSIRT services and obtain Huawei product vulnerability information, please visit http://www.huawei.com/en/psirt.

To report a security vulnerability in Huawei products and solutions, please send it to PSIRT@huawei.com. For details, please visit http://www.huawei.com/en/psirt/report-vulnerabilities.

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, either express or implied, including the warranties of merchantability or fitness for a particular purpose. In no event shall Huawei or any of its directly or indirectly controlled subsidiaries or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. Your use of the document, by whatsoever means, will be totally at your own risk. Huawei is entitled to amend or update this document from time to time.

Search

lenovo warranty check/lookup | check warranty status | lenovo support us