CVE-2018-7942

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have an authentication bypass vulnerability. An unauthenticated, remote attacker may send some specially crafted messages to the affected products. Due to improper authentication design, successful exploit may cause some information leak.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
Huawei Technologies Co., Ltd.	1288H V5; 2288H V5; 2488 V5; CH121 V3; CH121L V3; CH121L V5; CH121 V5; CH140 V3; CH140L V3; CH220 V3; CH222 V3; CH242 V3; CH242 V5; RH1288 V3; RH2288 V3; RH2288H V3; XH310 V3; XH321 V3; XH321 V5; XH62	1288H V5 V100R005C00; 2288H V5 V100R005C00; 2488 V5 V100R005C00; CH121 V3 V100R001C00; CH121L V3 V100R001C00; CH121L V5 V100R001C00; CH121 V5 V100R001C00; CH140 V3 V100R001C00; CH140L V3 V100R001C00; CH220 V3 V100R001C00; CH222 V3 V100R001C00; CH242 V3 V100R001C00; CH242 V5 V100R001C00; RH1288 V3 V100R003C00; RH2288 V3 V100R003C00; RH2288H V3 V100R003C00; XH310 V3 V100R003C00; XH321 V3 V100R003C00; XH321 V5 V100R005C00; XH620 V3 V100R003C00

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180523-01-server-enBroken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/143686Third Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180523-01-server-enBroken Link

Timeline

Published: May 24, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-79438.8There is an authentication bypass vulnerability in some Huawei servers. A remote attacker with low privilege may bypass the authentication b CVE-2018-79446.8Huawei smart phones Emily-AL00A with software 8.1.0.106(SP2C00) and 8.1.0.107(SP5C00) have a Factory Reset Protection (FRP) bypass vulnerabi CVE-2018-79464.3There is an information leak vulnerability in some Huawei smartphones. An attacker may do some specific configuration in the smartphone and CVE-2018-79473.9Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153(C00) have an authentication bypass vulnerability. An attacker could CVE-2018-79498.8The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability. A remote attacker m CVE-2018-79508.8The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input CVE-2018-79518.8The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input CVE-2018-79565.3Huawei VIP App is a mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20. There is a vulnerability in versions CVE-2018-79573.3Huawei smartphones with software Victoria-AL00 8.0.0.336a(C00) have an information leakage vulnerability. Because an interface does not veri CVE-2018-79587.4There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-i CVE-2018-79595.9There is a short key vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to interc CVE-2018-79607.4There is a SRTP icon display vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack t