« Back to list

CVE-2017-15328

Status: ModifiedHigh (7.5)—

Huawei HG8245H version earlier than V300R018C00SPC110 has an authentication bypass vulnerability. An attacker can access a specific URL of the affect product. Due to improper verification of the privilege, successful exploitation may cause information leak.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Huawei — Hg8245h Firmware

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2017-15328",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@huawei.com",
      "affectedData": [
        {
          "vendor": "Huawei Technologies Co., Ltd.",
          "product": "HG8245H",
          "versions": [
            {
              "status": "affected",
              "version": "Earlier than EchoLife HG8245H V300R018C00SPC110"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-12-22T17:29:13.500",
  "references": [
    {
      "url": "http://support.huawei.com/carrier/docview%21docview?nid=DOC1000441394&path=PBI1-7275726/PBI1-7275742/PBI1-7912539/PBI1-22318696/PBI1-8952133/PBI1-8957546/PBI1-22412232/PBI1-22412234/PBI1-22807623",
      "source": "psirt@huawei.com"
    },
    {
      "url": "https://hacked0x90.wordpress.com/2017/11/30/hg8245h-authentication-bypass/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "psirt@huawei.com"
    },
    {
      "url": "http://support.huawei.com/carrier/docview%21docview?nid=DOC1000441394&path=PBI1-7275726/PBI1-7275742/PBI1-7912539/PBI1-22318696/PBI1-8952133/PBI1-8957546/PBI1-22412232/PBI1-22412234/PBI1-22807623",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://hacked0x90.wordpress.com/2017/11/30/hg8245h-authentication-bypass/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Huawei HG8245H version earlier than V300R018C00SPC110 has an authentication bypass vulnerability. An attacker can access a specific URL of the affect product. Due to improper verification of the privilege, successful exploitation may cause information leak."
    },
    {
      "lang": "es",
      "value": "Huawei HG8245H en versiones anteriores a la V300R018C00SPC110 contiene una vulnerabilidad de omisión de autenticación. Un atacante puede acceder a un URL específica del producto afectado. Debido a una verificación incorrecta de los privilegios, una explotación exitosa podría dar lugar a una fuga de información."
    }
  ],
  "lastModified": "2026-06-17T01:07:36.067",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:hg8245h_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD6C81D0-8C6B-4BBE-BE29-A0B45E767E30",
              "versionEndExcluding": "v300r018c00spc110"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:hg8245h:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "CC7D61F0-543D-4087-A112-FDA4DDEC0C20"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@huawei.com"
}