Vulnerability Details : CVE-2018-7958
There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to hijack the connection from a client when the user signs up to log in by TLS. Due to insufficient authentication, which may be exploited to intercept and tamper with the data information.
Vulnerability category: BypassGain privilege
Products affected by CVE-2018-7958
- cpe:2.3:o:huawei:espace_7950_firmware:v200r003c30:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-7958
0.19%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 55 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-7958
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:N |
8.6
|
4.9
|
NIST | |
|
7.4
|
HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
2.2
|
5.2
|
NIST |
CWE ids for CVE-2018-7958
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-7958
-
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181114-01-espace-en
Security Advisory - Anonymous TLS Cipher Suite Supported Vulnerability in Huawei eSpace ProductVendor Advisory
Jump to