Details of VAR-201704-0490

ID

VAR-201704-0490

CVE

CVE-2016-8754

TITLE

Huawei OceanStor Vulnerable to use of hard-coded credentials

Trust: 0.8

sources: JVNDB: JVNDB-2016-008229

DESCRIPTION

Huawei OceanStor 5600 V3 V300R003C00 has a hardcoded SSH key vulnerability; the hardcoded keys are used to encrypt communication data and authenticate different nodes of the devices. An attacker may obtain the hardcoded keys and log in to such a device through SSH. Huawei OceanStor Contains a vulnerability involving the use of hard-coded credentials.Information is acquired, information is falsified, and denial of service (DoS) An attack could be made. Huawei OceanStor 5600 is a storage product of China Huawei. The Huawei OceanStor 5600 product has a hard-coded SSH key vulnerability. The device uses the SSH protocol for encrypted communication. The SSH public-private key is stored in the hard-coded format. And listen to the communication information. Huawei OceanStor 5800 V3 is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable device

Trust: 2.52

sources: NVD: CVE-2016-8754 // JVNDB: JVNDB-2016-008229 // CNVD: CNVD-2016-09675 // BID: 93607 // VULHUB: VHN-97574

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2016-09675

AFFECTED PRODUCTS

vendor:	huawei	model:	oceanstor 5600 v3	scope:	eq	version:	v300r003c00	Trust: 2.4
vendor:	huawei	model:	oceanstor v300r003c00	scope:	eq	version:	5600	Trust: 0.6
vendor:	huawei	model:	oceanstor v300r003c00	scope:	eq	version:	5600v3	Trust: 0.3
vendor:	huawei	model:	oceanstor v300r003c10spc100	scope:	ne	version:	5600v3	Trust: 0.3

sources: CNVD: CNVD-2016-09675 // BID: 93607 // JVNDB: JVNDB-2016-008229 // CNNVD: CNNVD-201610-667 // NVD: CVE-2016-8754

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-8754
value:	HIGH
Trust: 1.0
NVD:	CVE-2016-8754
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2016-09675
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201610-667
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-97574
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2016-8754
severity:	MEDIUM
baseScore:	5.4
vectorString:	AV:A/AC:M/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	5.5
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2016-09675
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-97574
severity:	MEDIUM
baseScore:	5.4
vectorString:	AV:A/AC:M/AU:N/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	5.5
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-8754
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.6
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2016-09675 // VULHUB: VHN-97574 // JVNDB: JVNDB-2016-008229 // CNNVD: CNNVD-201610-667 // NVD: CVE-2016-8754

PROBLEMTYPE DATA

problemtype:

CWE-798

Trust: 1.9

sources: VULHUB: VHN-97574 // JVNDB: JVNDB-2016-008229 // NVD: CVE-2016-8754

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201610-667

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201610-667

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-008229

PATCH

title:	huawei-sa-20161017-01-storage	url:	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161017-01-storage-en	Trust: 0.8
title:	HuaweiOceanStor5600 product hard-coded SSH key vulnerability patch	url:	https://www.cnvd.org.cn/patchInfo/show/82805	Trust: 0.6
title:	Huawei OceanStor 5800 V3 Repair measures for security bypass vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=64978	Trust: 0.6

sources: CNVD: CNVD-2016-09675 // JVNDB: JVNDB-2016-008229 // CNNVD: CNNVD-201610-667

EXTERNAL IDS

db:	NVD	id:	CVE-2016-8754	Trust: 3.4
db:	BID	id:	93607	Trust: 2.0
db:	JVNDB	id:	JVNDB-2016-008229	Trust: 0.8
db:	CNNVD	id:	CNNVD-201610-667	Trust: 0.7
db:	CNVD	id:	CNVD-2016-09675	Trust: 0.6
db:	VULHUB	id:	VHN-97574	Trust: 0.1

sources: CNVD: CNVD-2016-09675 // VULHUB: VHN-97574 // BID: 93607 // JVNDB: JVNDB-2016-008229 // CNNVD: CNNVD-201610-667 // NVD: CVE-2016-8754

REFERENCES

url:	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161017-01-storage-en	Trust: 2.0
url:	http://www.securityfocus.com/bid/93607	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-8754	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2016-8754	Trust: 0.8
url:	http://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20161017-01-storage-cn	Trust: 0.6
url:	http://www.huawei.com	Trust: 0.3

sources: CNVD: CNVD-2016-09675 // VULHUB: VHN-97574 // BID: 93607 // JVNDB: JVNDB-2016-008229 // CNNVD: CNNVD-201610-667 // NVD: CVE-2016-8754

CREDITS

Luiz Angelo Daros de Luca.

Trust: 0.9

sources: BID: 93607 // CNNVD: CNNVD-201610-667

SOURCES

db:	CNVD	id:	CNVD-2016-09675
db:	VULHUB	id:	VHN-97574
db:	BID	id:	93607
db:	JVNDB	id:	JVNDB-2016-008229
db:	CNNVD	id:	CNNVD-201610-667
db:	NVD	id:	CVE-2016-8754

LAST UPDATE DATE

2025-04-20T23:22:24.147000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2016-09675	date:	2016-11-02T00:00:00
db:	VULHUB	id:	VHN-97574	date:	2017-04-07T00:00:00
db:	BID	id:	93607	date:	2016-10-26T00:14:00
db:	JVNDB	id:	JVNDB-2016-008229	date:	2017-05-02T00:00:00
db:	CNNVD	id:	CNNVD-201610-667	date:	2016-10-21T00:00:00
db:	NVD	id:	CVE-2016-8754	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2016-09675	date:	2016-10-21T00:00:00
db:	VULHUB	id:	VHN-97574	date:	2017-04-02T00:00:00
db:	BID	id:	93607	date:	2016-10-17T00:00:00
db:	JVNDB	id:	JVNDB-2016-008229	date:	2017-05-02T00:00:00
db:	CNNVD	id:	CNNVD-201610-667	date:	2016-10-21T00:00:00
db:	NVD	id:	CVE-2016-8754	date:	2017-04-02T20:59:01.077