A vulnerability has been found in Huawei iBMC V200R002C10/V200R002C20/V200R002C30 and classified as problematic. This vulnerability affects an unknown functionality of the component Authorization. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality. CVE summarizes:

Huawei iBMC V200R002C10; V200R002C20; V200R002C30 have an improper authorization vulnerability. The software incorrectly performs an authorization check when a normal user attempts to access certain information which is supposed to be accessed only by admin user. Successful exploit could cause information disclosure.

The bug was discovered 01/31/2018. The weakness was shared 03/09/2018 (Website). The advisory is shared for download at huawei.com. This vulnerability was named CVE-2017-17323 since 12/04/2017. The attack can be initiated remotely. The successful exploitation needs a single authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 02/21/2023). The MITRE ATT&CK project declares the attack technique as T1548.002.

The vulnerability was handled as a non-public zero-day exploit for at least 37 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Vendor

• Huawei

Name

• iBMC

Version

• V200R002C10
• V200R002C20
• V200R002C30

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion