CVE-2018-7951: Huawei 1288h v5 Firmware

High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days.

The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to obtain the management privilege of the system.

Affected products

• Huawei 1288h v5 Firmware: version 100r005c00 only
• Huawei 2288h v5 Firmware: version 100r005c00 only
• Huawei 2488 v5 Firmware: version 100r005c00 only
• Huawei CH121 v3 Firmware: version 100r001c00 only
• Huawei CH121 v5 Firmware: version 100r001c00 only
• Huawei CH121L v3 Firmware: version 100r001c00 only
• Huawei CH121L v5 Firmware: version 100r001c00 only
• Huawei CH140 v3 Firmware: version 100r001c00 only
• Huawei CH140L v3 Firmware: version 100r001c00 only
• Huawei CH220 v3 Firmware: version 100r001c00 only
• Huawei CH222 v3 Firmware: version 100r001c00 only
• Huawei CH242 v3 Firmware: version 100r001c00 only
• Huawei CH242 v5 Firmware: version 100r001c00 only
• Huawei RH1288 v3 Firmware: version 100r003c00 only
• Huawei RH2288 v3 Firmware: version 100r003c00 only
• Huawei RH2288H v3 Firmware: version 100r003c00 only
• Huawei XH310 v3 Firmware: version 100r003c00 only
• Huawei XH321 v3 Firmware: version 100r003c00 only
• Huawei XH321 v5 Firmware: version 100r005c00 only
• Huawei XH620 v3 Firmware: version 100r003c00 only

Published 2018-06-01. Last modified 2026-06-17.