CVE-2015-7842

moderate-risk

Published 2017-10-10

Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allow remote authenticated operators to change server information by leveraging failure to verify user permissions.

Do I need to act?

0.24% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.1/10 High

NETWORK / LOW complexity

Affected Products (10)

Rh2288 V3 Firmware

Rh1288A V2 Firmware

Ch222 V3 Firmware

Ch121 V3 Firmware

Rh2288H V3 Firmware

Xh628 V3 Firmware

Rh1288 V3 Firmware

Rh2288A V2 Firmware

Rh8100 V3 Firmware

Ch220 V3 Firmware

Affected Vendors

Huawei

References (4)

Third Party Advisory http://www.securityfocus.com/bid/76836

Vendor Advisory http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/...

Third Party Advisory http://www.securityfocus.com/bid/76836

Vendor Advisory http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/...

/ 100

moderate-risk

Severity 25/34 · High

Exploitability 1/34 · Minimal

Exposure 16/34 · Moderate