Huawei Fusionaccess vulnerabilities

5 CVEs affecting Huawei Fusionaccess, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-9090, published 2020-10-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-8779, published 2017-04-02. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Huawei FusionAccess with software V100R005C10 and V100R005C20 could allow remote attackers with specific permission to inject a Lightweight Directory Access Protocol (LDAP) operation command into a…
CVE-2016-6839, published 2016-09-07. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. CRLF injection vulnerability in Huawei FusionAccess before V100R006C00 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVE-2015-7844, published 2017-04-02. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Huawei FusionAccess with software V100R005C10,V100R005C20 could allow attackers to craft and send a malformed HDP protocol packet to cause the virtual cloud desktop to be displaying an error and not…
CVE-2020-1825, published 2020-06-15. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. FusionAccess with versions earlier than 6.5.1.SPC002 have a Denial of Service (DoS) vulnerability. Due to insufficient verification on specific input, attackers can exploit this vulnerability by…
CVE-2020-9090, published 2020-10-12. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. FusionAccess version 6.5.1 has an improper authorization vulnerability. A command is authorized with incorrect privilege. Attackers with other privilege can execute the command to exploit this…