CVE-2015-8673

Huawei TE30, TE40, TE50, and TE60 multimedia video conferencing endpoints with software before V100R001C10SPC100 do not require entry of the old password when changing the password for the Debug account, which allows physically proximate attackers to change the password by leveraging an unattended workstation.

CVSS v3 6.8 MEDIUM
CVSS v2.0 4.6 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector : AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.huawei.com/en/psirt/security-advisories/hw-462952

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:huawei:te30:-:::::::*
	cpe:2.3:h:huawei:te40:-:::::::*
	cpe:2.3:h:huawei:te50:-:::::::*
	cpe:2.3:h:huawei:te60:-:::::::*

Configuration 2 (hide)

cpe:2.3:o:huawei:te60_firmware:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2016-01-12 20:59

Updated : 2024-02-28 15:21

NVD link : CVE-2015-8673

Mitre link : CVE-2015-8673

CVE.ORG link : CVE-2015-8673

JSON object : View

Products Affected

huawei

te30
te60
te60_firmware
te40
te50

CWE

CWE-255

Credentials Management Errors

{"id": "CVE-2015-8673", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "published": "2016-01-12T20:59:06.560", "references": [{"url": "http://www.huawei.com/en/psirt/security-advisories/hw-462952", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-255"}]}], "descriptions": [{"lang": "en", "value": "Huawei TE30, TE40, TE50, and TE60 multimedia video conferencing endpoints with software before V100R001C10SPC100 do not require entry of the old password when changing the password for the Debug account, which allows physically proximate attackers to change the password by leveraging an unattended workstation."}, {"lang": "es", "value": "Terminales de video conferencia multimedia Huawei TE30, TE40, TE50 y TE60 con software en versiones anteriores a V100R001C10SPC100 no requieren introducir la contrase\u00f1a antigua cuando se cambia la contrase\u00f1a de la cuenta Debug, lo que permite a atacantes f\u00edsicamente pr\u00f3ximos cambiar las contrase\u00f1as mediante el aprovechamiento de una estaci\u00f3n de trabajo desatendida."}], "lastModified": "2016-01-20T08:15:59.810", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:te30:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1146F99B-5344-4CD3-AF3F-CD3FE6F6DD91"}, {"criteria": "cpe:2.3:h:huawei:te40:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45C3AF58-E030-4E12-A2FD-A4337A5021ED"}, {"criteria": "cpe:2.3:h:huawei:te50:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4F188B3-0A63-4704-9B0D-F8DF5D973FA5"}, {"criteria": "cpe:2.3:h:huawei:te60:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "999117E9-90C8-4E76-90B5-7D364C0B84BF"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:te60_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FEC486C-0EEE-4D46-82C9-F5AC853B2224", "versionEndIncluding": "v100r001c10b022"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}