A vulnerability has been found in Huawei B2338-168 (affected version unknown) and classified as critical. This vulnerability affects an unknown functionality of the component Outdoor Unit. The manipulation with an unknown input leads to a missing authentication vulnerability. The CWE definition for the vulnerability is CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The outdoor unit of Customer Premise Equipment (CPE) product B2338-168 V100R001C00 has a no authentication vulnerability on a certain port. After accessing the network between the indoor and outdoor units of the CPE, an attacker can deliver commands to the specific port of the outdoor unit and execute them without authentication. Successful exploit could allow the attacker to take control over the outdoor unit.

The bug was discovered 09/20/2017. The weakness was shared 11/22/2017 (Website). The advisory is available at huawei.com. This vulnerability was named CVE-2017-8155 since 04/25/2017. The exploitation appears to be easy. Local access is required to approach this attack. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available.

The vulnerability was handled as a non-public zero-day exploit for at least 63 days. During that time the estimated underground price was around $5k-$25k.

Upgrading eliminates this vulnerability.

The entry VDB-109895 is related to this item.

Productinfo

Vendor

• Huawei

Name

• B2338-168

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion