CVE-2017-17167

Huawei DP300 V500R002C00; TP3206 V100R002C00; ViewPoint 9030 V100R011C02; V100R011C03 have a use of a broken or risky cryptographic algorithm vulnerability. The software uses risky cryptographic algorithm in SSL. This is dangerous because a remote unauthenticated attacker could use well-known techniques to break the algorithm. Successful exploit could result in the exposure of sensitive information.

CVSS v3 5.9 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171215-01-ssl-en	Vendor Advisory
http://www.securityfocus.com/bid/103513

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:huawei:dp300_firmware:v500r002c00:*:*:*:*:*:*:*

cpe:2.3:h:huawei:dp300:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:huawei:tp3206_firmware:v100r002c00:*:*:*:*:*:*:*

cpe:2.3:h:huawei:tp3206:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

OR	cpe:2.3:o:huawei:viewpoint_9030_firmware:v100r011c02:::::::*
	cpe:2.3:o:huawei:viewpoint_9030_firmware:v100r011c03:::::::*

cpe:2.3:h:huawei:viewpoint_9030:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-03-09 17:29

Updated : 2024-02-28 16:25

NVD link : CVE-2017-17167

Mitre link : CVE-2017-17167

CVE.ORG link : CVE-2017-17167

JSON object : View

Products Affected

huawei

tp3206
viewpoint_9030
viewpoint_9030_firmware
tp3206_firmware
dp300_firmware
dp300

CWE

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

{"id": "CVE-2017-17167", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2018-03-09T17:29:00.643", "references": [{"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171215-01-ssl-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}, {"url": "http://www.securityfocus.com/bid/103513", "source": "psirt@huawei.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-327"}]}], "descriptions": [{"lang": "en", "value": "Huawei DP300 V500R002C00; TP3206 V100R002C00; ViewPoint 9030 V100R011C02; V100R011C03 have a use of a broken or risky cryptographic algorithm vulnerability. The software uses risky cryptographic algorithm in SSL. This is dangerous because a remote unauthenticated attacker could use well-known techniques to break the algorithm. Successful exploit could result in the exposure of sensitive information."}, {"lang": "es", "value": "Huawei DP300 V500R002C00; TP3206 V100R002C00 y ViewPoint 9030 V100R011C02 y V100R011C03 tienen una vulnerabilidad de uso de algoritmo criptogr\u00e1fico roto o con riesgo. El software emplea un algoritmo criptogr\u00e1fico con riesgo en SSL. Esto es peligroso porque un atacante remoto no autenticado podr\u00eda emplear t\u00e9cnicas conocidas para romper el algoritmo. La explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda resultar en la exposici\u00f3n de informaci\u00f3n sensible."}], "lastModified": "2018-03-29T01:29:00.447", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:dp300_firmware:v500r002c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8871106B-D3AF-4CFB-A544-1FA411642428"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:dp300:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7F3483B2-9EB6-4E34-900A-945C04A3160D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:tp3206_firmware:v100r002c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D28E0627-0B19-4616-933E-76294F83813F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:tp3206:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "45ED506D-5094-476B-83F0-CBBED04EF348"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:viewpoint_9030_firmware:v100r011c02:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C83F8B1-67D2-4D4C-8FB5-2C61EDD0FCF3"}, {"criteria": "cpe:2.3:o:huawei:viewpoint_9030_firmware:v100r011c03:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0ADEC8B2-CD7F-4246-88C0-E27B939829AB"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:viewpoint_9030:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F6208C34-D92D-4605-B4AF-6EA597CBA0F2"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}