High severity · published Nov 27, 2018
CVE-2018-7958
There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product
7.4
CVSS
1.1%
EPSS
No
On KEV
Description
There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to hijack the connection from a client when the user signs up to log in by TLS. Due to insufficient authentication, which may be exploited to intercept and tamper with the data information.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
E7
Espace 7950 Firmware · Huawei
v200r003c30 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7958
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7958
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20181114-01-espace-en
More from Espace 7950 Firmware
8.8
CVE-2017-17223
Huawei eSpace 7910 V200R003C30; eSpace 7950 V200R003C30; eSpace 8950 V200R003C00; V200R003C30 have a directory traversal vulnerability
8.8
CVE-2017-17222
Import Language Package function in Huawei eSpace 7950 V200R003C30; eSpace 8950 V200R003C00; V200R003C30 has a remote code execution vulnerability
8.8
CVE-2017-17221
Import Signal Tone function in Huawei eSpace 7950 V200R003C30; eSpace 8950 V200R003C00; V200R003C30 has a remote code execution vulnerability
8.8
CVE-2017-2722
DP300 V500R002C00,TE60 with software V100R001C01, V100R001C10, V100R003C00, V500R002C00 and V600R006C00,TP3106 with software V100R001C06 and V100R002C00,ViewPoint 9030 with…
7.4
CVE-2018-7960
There is a SRTP icon display vulnerability in Huawei eSpace product