VulnerabilityModified

CVE-2018-7942

The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have an authentication bypass vulnerability.

HIGH 7.5EPSS 1.63%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.63%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have an authentication bypass vulnerability. An unauthenticated, remote attacker may send some specially crafted messages to the affected products. Due to improper authentication design, successful exploit may cause some information leak.

CVSS 3.0: 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 1.63% probability · 75th percentile
CISA KEV: Not listed
Affected: huawei/1288h v5 firmware · huawei/2288h v5 firmware · huawei/2488 v5 firmware · huawei/ch242 v3 firmware · huawei/ch121l v3 firmware · huawei/ch121l v5 firmware · huawei/ch121 v3 firmware
Source: psirt@huawei.com

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180523-01-server-enBroken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/143686Third Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180523-01-server-enBroken Link

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.