CVE-2014-9696

The Hyper Module Management (HMM) software of Huawei Tecal E9000 Chassis V100R001C00SPC160 and earlier versions allows the operator to modify the user configuration of iMana through privilege escalation.

CVSS v3 8.8 HIGH
CVSS v2.0 6.5 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.huawei.com/en/psirt/security-advisories/hw-408117	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:huawei:tecal_e9000_chassis_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:huawei:tecal_e9000_chassis:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-04-02 20:59

Updated : 2023-12-10 12:01

NVD link : CVE-2014-9696

Mitre link : CVE-2014-9696

CVE.ORG link : CVE-2014-9696

JSON object : View

Products Affected

huawei

tecal_e9000_chassis
tecal_e9000_chassis_firmware

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2014-9696", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2017-04-02T20:59:00.687", "references": [{"url": "http://www.huawei.com/en/psirt/security-advisories/hw-408117", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The Hyper Module Management (HMM) software of Huawei Tecal E9000 Chassis V100R001C00SPC160 and earlier versions allows the operator to modify the user configuration of iMana through privilege escalation."}, {"lang": "es", "value": "El software Hyper Module Management (HMM) de Huawei Tecal E9000 Chassis V100R001C00SPC160 y versiones anteriores permite al operador modificar la configuraci\u00f3n de usuario de iMana mediante la escalada de privilegios."}], "lastModified": "2017-04-05T18:45:20.133", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:tecal_e9000_chassis_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "257DEC1E-68D1-4CB5-80B8-A95406BA50A9", "versionEndIncluding": "v100r001c00spc160"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:tecal_e9000_chassis:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5E94FF9D-1F20-447F-AF2D-E2326F3DB02E"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}