var-201511-0200
Vulnerability from variot
Directory traversal vulnerability in the SFTP server in Huawei AR 120, 150, 160, 200, 500, 1200, 2200, 3200, and 3600 routers with software before V200R006SPH003 allows remote authenticated users to access arbitrary directories via unspecified vectors. Huawei AR Routers is an AR series router product from China Huawei. A directory traversal vulnerability exists in the Huawei AR router. An attacker could exploit this vulnerability to obtain sensitive information. Huawei AR series routers are Huawei's proprietary VRP-based next-generation enterprise routers that integrate routing, switching, 3G, WLAN, voice, and security functions. The following versions and products are affected: Huawei AR 120, 150, 160, 200, 500, 1200, 2200, 3200, 3600 versions earlier than V200R006C10
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201511-0200", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "ar", "scope": "lte", "trust": 1.0, "vendor": "huawei", "version": "v200r006c10" }, { "model": "ar router", "scope": "lt", "trust": 0.8, "vendor": "huawei", "version": "v200r006sph003" }, { "model": "ar120", "scope": null, "trust": 0.8, "vendor": "huawei", "version": null }, { "model": "ar1200", "scope": null, "trust": 0.8, "vendor": "huawei", "version": null }, { "model": "ar150", "scope": null, "trust": 0.8, "vendor": "huawei", "version": null }, { "model": "ar160", "scope": null, "trust": 0.8, "vendor": "huawei", "version": null }, { "model": "ar200", "scope": null, "trust": 0.8, "vendor": "huawei", "version": null }, { "model": "ar2200", "scope": null, "trust": 0.8, "vendor": "huawei", "version": null }, { "model": "ar3200", "scope": null, "trust": 0.8, "vendor": "huawei", "version": null }, { "model": "ar3600", "scope": null, "trust": 0.8, "vendor": "huawei", "version": null }, { "model": "ar500", "scope": null, "trust": 0.8, "vendor": "huawei", "version": null }, { "model": "ar routers", "scope": null, "trust": 0.6, "vendor": "huawei", "version": null }, { "model": "ar", "scope": "eq", "trust": 0.6, "vendor": "huawei", "version": "150" }, { "model": "ar", "scope": "eq", "trust": 0.6, "vendor": "huawei", "version": "200" }, { "model": "ar", "scope": "eq", "trust": 0.6, "vendor": "huawei", "version": "1200" }, { "model": "ar", "scope": "eq", "trust": 0.6, "vendor": "huawei", "version": "2200" }, { "model": "ar", "scope": "eq", "trust": 0.6, "vendor": "huawei", "version": "3200" }, { "model": "ar", "scope": "eq", "trust": 0.6, "vendor": "huawei", "version": "120" }, { "model": "ar", "scope": "eq", "trust": 0.6, "vendor": "huawei", "version": "160" }, { "model": "ar", "scope": "eq", "trust": 0.6, "vendor": "huawei", "version": "500" }, { "model": "ar", "scope": "eq", "trust": 0.6, "vendor": "huawei", "version": "3600" }, { "model": "ar", "scope": "eq", "trust": 0.6, "vendor": "huawei", "version": "v200r006c10" }, { "model": "ar1200 v200r006c10", "scope": null, "trust": 0.3, "vendor": "huawei", "version": null }, { "model": "ar1200 v200r006sph003", "scope": "ne", "trust": 0.3, "vendor": "huawei", "version": null } ], "sources": [ { "db": "CNVD", "id": "CNVD-2015-07773" }, { "db": "CNVD", "id": "CNVD-2015-07794" }, { "db": "BID", "id": "77555" }, { "db": "JVNDB", "id": "JVNDB-2015-006027" }, { "db": "NVD", "id": "CVE-2015-8228" }, { "db": "CNNVD", "id": "CNNVD-201511-394" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:huawei:ar_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "v200r006c10", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:huawei:ar160:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:h:huawei:ar200:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:h:huawei:ar500:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:h:huawei:ar150:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:h:huawei:ar1200:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:h:huawei:ar2200:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:h:huawei:ar3200:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:h:huawei:ar3600:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false }, { "cpe23Uri": "cpe:2.3:h:huawei:ar120:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2015-8228" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Huawei", "sources": [ { "db": "BID", "id": "77555" }, { "db": "CNNVD", "id": "CNNVD-201511-394" } ], "trust": 0.9 }, "cve": "CVE-2015-8228", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.0, "impactScore": 2.9, "integrityImpact": "NONE", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Low", "accessVector": "Network", "authentication": "Single", "author": "NVD", "availabilityImpact": "None", "baseScore": 4.0, "confidentialityImpact": "Partial", "exploitabilityScore": null, "id": "CVE-2015-8228", "impactScore": null, "integrityImpact": "None", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "CNVD", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 10.0, "id": "CNVD-2015-07773", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.6, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "CNVD", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.0, "id": "CNVD-2015-07794", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.6, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "VULHUB", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.0, "id": "VHN-86189", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:S/C:P/I:N/A:N", "version": "2.0" } ], "cvssV3": [], "severity": [ { "author": "NVD", "id": "CVE-2015-8228", "trust": 1.8, "value": "MEDIUM" }, { "author": "CNVD", "id": "CNVD-2015-07773", "trust": 0.6, "value": "MEDIUM" }, { "author": "CNVD", "id": "CNVD-2015-07794", "trust": 0.6, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-201511-394", "trust": 0.6, "value": "MEDIUM" }, { "author": "VULHUB", "id": "VHN-86189", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "CNVD", "id": "CNVD-2015-07773" }, { "db": "CNVD", "id": "CNVD-2015-07794" }, { "db": "VULHUB", "id": "VHN-86189" }, { "db": "JVNDB", "id": "JVNDB-2015-006027" }, { "db": "NVD", "id": "CVE-2015-8228" }, { "db": "CNNVD", "id": "CNNVD-201511-394" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Directory traversal vulnerability in the SFTP server in Huawei AR 120, 150, 160, 200, 500, 1200, 2200, 3200, and 3600 routers with software before V200R006SPH003 allows remote authenticated users to access arbitrary directories via unspecified vectors. Huawei AR Routers is an AR series router product from China Huawei. A directory traversal vulnerability exists in the Huawei AR router. An attacker could exploit this vulnerability to obtain sensitive information. Huawei AR series routers are Huawei\u0027s proprietary VRP-based next-generation enterprise routers that integrate routing, switching, 3G, WLAN, voice, and security functions. The following versions and products are affected: Huawei AR 120, 150, 160, 200, 500, 1200, 2200, 3200, 3600 versions earlier than V200R006C10", "sources": [ { "db": "NVD", "id": "CVE-2015-8228" }, { "db": "JVNDB", "id": "JVNDB-2015-006027" }, { "db": "CNVD", "id": "CNVD-2015-07773" }, { "db": "CNVD", "id": "CNVD-2015-07794" }, { "db": "BID", "id": "77555" }, { "db": "VULHUB", "id": "VHN-86189" } ], "trust": 3.06 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2015-8228", "trust": 3.1 }, { "db": "BID", "id": "77555", "trust": 1.5 }, { "db": "JVNDB", "id": "JVNDB-2015-006027", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201511-394", "trust": 0.7 }, { "db": "CNVD", "id": "CNVD-2015-07773", "trust": 0.6 }, { "db": "CNVD", "id": "CNVD-2015-07794", "trust": 0.6 }, { "db": "NSFOCUS", "id": "31618", "trust": 0.6 }, { "db": "SEEBUG", "id": "SSVID-89883", "trust": 0.1 }, { "db": "SEEBUG", "id": "SSVID-89929", "trust": 0.1 }, { "db": "VULHUB", "id": "VHN-86189", "trust": 0.1 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2015-07773" }, { "db": "CNVD", "id": "CNVD-2015-07794" }, { "db": "VULHUB", "id": "VHN-86189" }, { "db": "BID", "id": "77555" }, { "db": "JVNDB", "id": "JVNDB-2015-006027" }, { "db": "NVD", "id": "CVE-2015-8228" }, { "db": "CNNVD", "id": "CNNVD-201511-394" } ] }, "id": "VAR-201511-0200", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "CNVD", "id": "CNVD-2015-07773" }, { "db": "CNVD", "id": "CNVD-2015-07794" }, { "db": "VULHUB", "id": "VHN-86189" } ], "trust": 2.1753561133333332 }, "iot_taxonomy": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "category": [ "Network device" ], "sub_category": null, "trust": 1.2 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2015-07773" }, { "db": "CNVD", "id": "CNVD-2015-07794" } ] }, "last_update_date": "2023-12-18T13:39:13.375000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Huawei-SA-20151111-01-AR", "trust": 0.8, "url": "http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-461676.htm" }, { "title": "Huawei AR router directory traversal vulnerability patch", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchinfo/show/67110" }, { "title": "Huawei AR router SFTP server directory traversal vulnerability patch", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchinfo/show/67214" }, { "title": "Huawei AR Repair measures for router directory traversal vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=58842" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2015-07773" }, { "db": "CNVD", "id": "CNVD-2015-07794" }, { "db": "JVNDB", "id": "JVNDB-2015-006027" }, { "db": "CNNVD", "id": "CNNVD-201511-394" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-22", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-86189" }, { "db": "JVNDB", "id": "JVNDB-2015-006027" }, { "db": "NVD", "id": "CVE-2015-8228" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.7, "url": "http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-461676.htm" }, { "trust": 1.2, "url": "http://www.securityfocus.com/bid/77555" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-8228" }, { "trust": 0.8, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-8228" }, { "trust": 0.6, "url": "http://www.huawei.com/en/security/psirt/report-vulnerabilities/index.htm" }, { "trust": 0.6, "url": "http://www.nsfocus.net/vulndb/31618" }, { "trust": 0.3, "url": "http://www.huawei.com" }, { "trust": 0.3, "url": "http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/archive/hw-461676.htm" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2015-07773" }, { "db": "CNVD", "id": "CNVD-2015-07794" }, { "db": "VULHUB", "id": "VHN-86189" }, { "db": "BID", "id": "77555" }, { "db": "JVNDB", "id": "JVNDB-2015-006027" }, { "db": "NVD", "id": "CVE-2015-8228" }, { "db": "CNNVD", "id": "CNNVD-201511-394" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "CNVD", "id": "CNVD-2015-07773" }, { "db": "CNVD", "id": "CNVD-2015-07794" }, { "db": "VULHUB", "id": "VHN-86189" }, { "db": "BID", "id": "77555" }, { "db": "JVNDB", "id": "JVNDB-2015-006027" }, { "db": "NVD", "id": "CVE-2015-8228" }, { "db": "CNNVD", "id": "CNNVD-201511-394" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2015-11-25T00:00:00", "db": "CNVD", "id": "CNVD-2015-07773" }, { "date": "2015-11-26T00:00:00", "db": "CNVD", "id": "CNVD-2015-07794" }, { "date": "2015-11-24T00:00:00", "db": "VULHUB", "id": "VHN-86189" }, { "date": "2015-11-11T00:00:00", "db": "BID", "id": "77555" }, { "date": "2015-11-26T00:00:00", "db": "JVNDB", "id": "JVNDB-2015-006027" }, { "date": "2015-11-24T20:59:21.130000", "db": "NVD", "id": "CVE-2015-8228" }, { "date": "2015-11-23T00:00:00", "db": "CNNVD", "id": "CNNVD-201511-394" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2015-11-25T00:00:00", "db": "CNVD", "id": "CNVD-2015-07773" }, { "date": "2015-11-26T00:00:00", "db": "CNVD", "id": "CNVD-2015-07794" }, { "date": "2015-11-25T00:00:00", "db": "VULHUB", "id": "VHN-86189" }, { "date": "2015-11-11T00:00:00", "db": "BID", "id": "77555" }, { "date": "2015-11-26T00:00:00", "db": "JVNDB", "id": "JVNDB-2015-006027" }, { "date": "2015-11-25T18:31:29.490000", "db": "NVD", "id": "CVE-2015-8228" }, { "date": "2015-12-15T00:00:00", "db": "CNNVD", "id": "CNNVD-201511-394" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201511-394" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Huawei AR Router Directory Traversal Vulnerability", "sources": [ { "db": "CNVD", "id": "CNVD-2015-07773" }, { "db": "CNNVD", "id": "CNNVD-201511-394" } ], "trust": 1.2 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "path traversal", "sources": [ { "db": "CNNVD", "id": "CNNVD-201511-394" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.