Identity Bypass in Huawei AJMD-370S

1) Improper access control

EUVDB-ID: #VU83906

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6514

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to identity authentication bypass issue. A remote attacker on the local network can access restricted functions.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

AJMD-370S: 103.1.0.110(SP12C00E2R1P2)

CPE2.3

• cpe:2.3:h:huawei:ajmd-370s:103.1.0.110(SP12C00E2R1P2):*:*:*:*:*:*:

External links

http://www.huawei.com/en/psirt/security-advisories/2023/huawei-sa-ibvishssp-4bf951d4-en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.