Huawei Oceanstor Uds Firmware vulnerabilities

4 CVEs affecting Huawei Oceanstor Uds Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-2254, published 2019-03-13.

More from Huawei.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-2252, published 2017-06-08. High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days. Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted UDS patch with shell scripts.
• CVE-2015-2251, published 2017-06-08. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. The DeviceManager in Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to obtain sensitive information via a crafted UDS patch with JavaScript.
• CVE-2015-2254, published 2019-03-13. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to capture and change patch loading information resulting in the deletion of directory files and…
• CVE-2015-2253, published 2017-06-08. Medium severity, CVSS 5.0. EPSS: 0.6% chance of exploitation in the next 30 days. The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensitive information via a crafted XML document.