Huawei s2700 Firmware vulnerabilities

18 CVEs affecting Huawei s2700 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-37129, published 2021-10-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-2808, published 2015-04-01. Low severity, CVSS 3.7. EPSS: 73.9% chance of exploitation in the next 30 days. The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to…
CVE-2014-5394, published 2018-01-08. Medium severity, CVSS 5.9. EPSS: 1.7% chance of exploitation in the next 30 days. Multiple Huawei Campus switches allow remote attackers to enumerate usernames via vectors involving use of SSH by the maintenance terminal.
CVE-2019-5285, published 2019-06-04. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. Some Huawei S series switches have a DoS vulnerability. An unauthenticated remote attacker can send crafted packets to the affected device to exploit this vulnerability. Due to insufficient…
CVE-2017-17250, published 2018-03-09. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Huawei AR120-S V200R005C32; AR1200 V200R005C32; AR1200-S V200R005C32; AR150 V200R005C32; AR150-S V200R005C32; AR160 V200R005C32; AR200 V200R005C32; AR200-S V200R005C32; AR2200-S V200R005C32; AR3200…
CVE-2017-17165, published 2018-02-15. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. IPv6 function in Huawei Quidway S2700 V200R003C00SPC300, Quidway S5300 V200R003C00SPC300, Quidway S5700 V200R003C00SPC300, S2300 V200R003C00, V200R003C00SPC300T, V200R005C00, V200R006C00,…
CVE-2017-8147, published 2017-11-22. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. AC6005 V200R006C10SPC200,AC6605 V200R006C10SPC200,AR1200 with software V200R005C10CP0582T, V200R005C10HP0581T, V200R005C20SPC026T,AR200 with software V200R005C20SPC026T,AR3200…
CVE-2015-3913, published 2017-06-08. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. The IP stack in multiple Huawei Campus series switch models allows remote attackers to cause a denial of service (reboot) via a crafted ICMP request message.
CVE-2021-22377, published 2021-06-22. High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days. There is a command injection vulnerability in S12700 V200R019C00SPC500, S2700 V200R019C00SPC500, S5700 V200R019C00SPC500, S6700 V200R019C00SPC500 and S7700 V200R019C00SPC500. A module does not verify…
CVE-2019-19397, published 2019-12-13. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. There is a weak algorithm vulnerability in some Huawei products. The affected products use weak algorithms by default. Attackers may exploit the vulnerability to cause information leaks.
CVE-2021-22321, published 2021-03-22. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. There is a use-after-free vulnerability in a Huawei product. A module cannot deal with specific operations in special scenarios. Attackers can exploit this vulnerability by performing malicious…

Latest

CVE-2021-37129, published 2021-10-27. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. There is an out of bounds write vulnerability in some Huawei products. The vulnerability is caused by a function of a module that does not properly verify input parameter. Successful exploit could…
CVE-2021-22329, published 2021-06-29. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. There has a license management vulnerability in some Huawei products. An attacker with high privilege needs to perform specific operations to exploit the vulnerability on the affected device. Due to…
CVE-2020-1866, published 2021-01-13. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. There is an out-of-bounds read vulnerability in several products. The software reads data past the end of the intended buffer when parsing certain crafted DHCP messages. Successful exploit could…
CVE-2017-17141, published 2018-03-05. Low severity, CVSS 3.7. EPSS: 0.7% chance of exploitation in the next 30 days. Huawei S12700 V200R005C00; V200R006C00; V200R007C00; V200R007C01; V200R007C20; V200R008C00; V200R009C00;S1700 V200R006C10; V200R009C00;S2700 V100R006C03; V200R003C00; V200R005C00; V200R006C00;…
CVE-2017-17138, published 2018-03-05. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. PEM module of DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6300 V500R001C00; V500R001C30; NIP6600 V500R001C00; V500R001C30; RP200 V500R002C00;…