Weak Algorithm Vulnerability in Huawei Products
CVE-2017-17174

5.9MEDIUM

Key Information:

Vendor
McAfee
Status
Rse6500; Softco; Vp9660; Espace U1981
Vendor
CVE Published:
31 July 2018

Summary

A weak algorithm vulnerability has been identified in several Huawei products, including the RSE6500 and eSpace series. This flaw allows remote, unauthenticated attackers to intercept TLS traffic between client devices and the affected products. By exploiting this vulnerability, attackers can execute a Bleichenbacher attack on the RSA key exchange process, which enables them to decrypt session keys and access previously captured sessions. This could potentially lead to unauthorized information disclosure.

Affected Version(s)

RSE6500; SoftCo; VP9660; eSpace U1981 RSE6500 V500R002C00

RSE6500; SoftCo; VP9660; eSpace U1981 SoftCo V200R003C20SPCb00

RSE6500; SoftCo; VP9660; eSpace U1981 VP9660 V600R006C10

References

http://www.huawei.com/en/psirt/security-advisories/huawei...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.