Huawei Hedex Lite vulnerabilities

5 CVEs affecting Huawei Hedex Lite, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-5286, published 2019-06-13.

More from Huawei.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-8137, published 2017-11-22. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. HedEx Earlier than V200R006C00 versions has a dynamic link library (DLL) hijacking vulnerability due to calling the DDL file by accessing a relative path. An attacker could exploit this vulnerability…
• CVE-2019-5286, published 2019-06-13. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. There is a reflection XSS vulnerability in the HedEx products. Remote attackers send malicious links to users and trick users to click. Successfully exploit cloud allow the attacker to initiate XSS…
• CVE-2017-8136, published 2017-11-22. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. HedEx Earlier than V200R006C00 versions has an arbitrary file download vulnerability. An attacker could exploit it to download arbitrary files on a target device to cause information leak.
• CVE-2017-8139, published 2017-11-22. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. HedEx Earlier than V200R006C00 versions have the stored cross-site scripting (XSS) vulnerability. Attackers can exploit the vulnerability to plant malicious scripts into the configuration file to…
• CVE-2017-8138, published 2017-11-22. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. HedEx Earlier than V200R006C00 versions has a cross-site request forgery (CSRF) vulnerability. An attacker could trick a user into accessing a website containing malicious scripts which may tamper…