This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy
Huawei E355 portable 3G wireless routers have the stored cross-site scripting (XSS) vulnerability. Attackers can exploit the vulnerability to plant malicious scripts into the configuration file to interrupt the services of legitimate users. (Vulnerability ID: HWPSIRT-2014-0516)
The CVE No. of the vulnerability is CVE-2014-2968.
Product Name |
Affected Version |
Resolved Product and Version |
E355 |
Software version: 21.157.37.01.910 |
Software version: 22.158.45.02.910 |
Attackers can exploit the vulnerability to interrupt the services of legitimate users to a limited extent.
The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).
Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Temporal Score: 4.2 (E:F/RL:O/RC:C)
1. Prerequisite:
1) Attackers can access the LAN ports of the target device.
2) Legitimate users must be online during the attack.
2. Attacking procedure:
Huawei E355 portable 3G wireless routers has the stored cross-site scripting (XSS) vulnerability. Attackers can send specially grafted HTTP post packets to plant malicious scripts into the configuration file to interrupt the services of legitimate users.
When the vulnerability is exploited, the impact is some unwanted pop-ups when legitimate users access the web page of the device. The malicious scripts have limited permissions and cannot modify device configuration or leak user information.
The vulnerability is discovered by Jimson K James. Huawei PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
Huawei thanks Jimson K James for the responsible vulnerability report.
For security problems about Huawei products and solutions, please contactPSIRT@huawei.com.
For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.
2014-10-11 V1.0 INITIAL
None