CVE-2018-7950

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to obtain the management privilege of the system.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Huawei Technologies Co., Ltd.	1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5 ; CH121 V5 ; CH140 V3; CH140L V3; CH220 V3; CH222 V3; CH242 V3; CH242 V5 ; RH1288 V3; RH2288 V3; RH2288H V3; XH310 V3; XH321 V3; XH321 V5;	1288H V5 V100R005C00; 2288H V5 V100R005C00; 2488 V5 V100R005C00; CH121 V3 V100R001C00; CH121L V3 V100R001C00; CH121L V5 V100R001C00; CH121 V5 V100R001C00; CH140 V3 V100R001C00; CH140L V3 V100R001C00; CH220 V3 V100R001C00; CH222 V3 V100R001C00; CH242 V3 V100R001C00; CH242 V5 V100R001C00; RH1288 V3 V100R003C00; RH2288 V3 V100R003C00; RH2288H V3 V100R003C00; XH310 V3 V100R003C00; XH321 V3 V100R003C00; XH321 V5 V100R005C00; XH620 V3 V100R003C00

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180530-02-server-enVendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180530-02-server-enVendor Advisory

Timeline

Published: Jun 1, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-79518.8The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input CVE-2018-79565.3Huawei VIP App is a mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20. There is a vulnerability in versions CVE-2018-79573.3Huawei smartphones with software Victoria-AL00 8.0.0.336a(C00) have an information leakage vulnerability. Because an interface does not veri CVE-2018-79587.4There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-i CVE-2018-79595.9There is a short key vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to interc CVE-2018-79607.4There is a SRTP icon display vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack t CVE-2018-79616.5There is a smart SMS verification code vulnerability in some Huawei smart phones. An attacker should trick a user to access malicious Websit CVE-2018-79765.4There is a stored cross-site scripting (XSS) vulnerability in Huawei eSpace Desktop V300R001C00 and V300R001C50 version. Due to the insuffic CVE-2018-79777.5There is an information leakage vulnerability on several Huawei products. Due to insufficient communication protection for specific services CVE-2018-79875.9There is an out-of-bounds write vulnerability on Huawei P20 smartphones with versions before 8.1.0.171(C00). The software does not handle th CVE-2018-79884.6There is a Factory Reset Protection (FRP) bypass vulnerability on several smartphones. The system does not sufficiently verify the permissio CVE-2018-79894.6Huawei Mate 10 pro smartphones with the versions before BLA-AL00B 8.1.0.326(C00) have an improper authentication vulnerability. App Lock is