CVE-2016-8785 : Huawei S12700 V200R007C00, V200R008C00, S5700 V200R007C00, S7700 V200R002C00, V2

Huawei S12700 V200R007C00, V200R008C00, S5700 V200R007C00, S7700 V200R002C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, S9700 V200R007C00 have an input validation vulnerability. Due to the lack of input validation, an attacker may craft a malformed packet and send it to the device using VRP, causing the device to display additional memory data and possibly leading to sensitive information leakage.

Published 2018-03-09 21:29:00

Updated 2018-03-26 15:24:34

Source Huawei Technologies

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2016-8785

Huawei » S7700 Firmware » Version: V200r006c00
cpe:2.3:o:huawei:s7700_firmware:v200r006c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » S7700 » Version: N/A
Huawei » S7700 Firmware » Version: V200r002c00
cpe:2.3:o:huawei:s7700_firmware:v200r002c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » S7700 » Version: N/A
Huawei » S7700 Firmware » Version: V200r005c00
cpe:2.3:o:huawei:s7700_firmware:v200r005c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » S7700 » Version: N/A
Huawei » S7700 Firmware » Version: V200r008c00
cpe:2.3:o:huawei:s7700_firmware:v200r008c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » S7700 » Version: N/A
Huawei » S7700 Firmware » Version: V200r007c00
cpe:2.3:o:huawei:s7700_firmware:v200r007c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » S7700 » Version: N/A
Huawei » S9700 Firmware » Version: V200r007c00
cpe:2.3:o:huawei:s9700_firmware:v200r007c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » S9700 » Version: N/A
Huawei » S12700 Firmware » Version: V200r008c00
cpe:2.3:o:huawei:s12700_firmware:v200r008c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » S12700 » Version: N/A
Huawei » S12700 Firmware » Version: V200r007c00
cpe:2.3:o:huawei:s12700_firmware:v200r007c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » S12700 » Version: N/A
Huawei » S5700 Firmware » Version: V200r007c00
cpe:2.3:o:huawei:s5700_firmware:v200r007c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » S5700 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2016-8785

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 31 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-8785

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
4.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2016-8785

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-8785

http://www.securityfocus.com/bid/95149

Multiple Huawei Products CVE-2016-8785 Information Disclosure Vulnerability
Third Party Advisory;VDB Entry
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161228-04-vrp-en

Security Advisory - Input Validation Vulnerability in Huawei VRP Platform
Vendor Advisory

Jump to

Vulnerability Details : CVE-2016-8785

Products affected by CVE-2016-8785

Exploit prediction scoring system (EPSS) score for CVE-2016-8785

CVSS scores for CVE-2016-8785

CWE ids for CVE-2016-8785

References for CVE-2016-8785