CVE-2012-6571

Published: Jun 20, 2013Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The HTTP module in the (1) Branch Intelligent Management System (BIMS) and (2) web management components on Huawei AR routers and S2000, S3000, S3500, S3900, S5100, S5600, and S7800 switches uses predictable Session ID values, which makes it easier for remote attackers to hijack sessions via a brute-force attack.

Affected (19)

Products: Huawei: Ar 18 1x, Ar 18 2x, Ar 18 3x, Ar 19/29/49, Ar 28/46, S2000, S2300, S2700, S3000, S3300, S3300hi, S3500, S3700, S3900, S5100, S5600, S7800, S8500

18 products

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Huawei Ar 18 1x	Up to r0130
Huawei Ar 18 2x	Up to r1712
Huawei Ar 18 3x	Up to r0118
Huawei Ar 19/29/49	Up to r2207
Huawei Ar 28/46	Up to r0311

Configuration B

14 vulnerable

Vulnerable Software	Affected Versions
Huawei S2000	Version r6305
Huawei S2300	Version r6305
Huawei S2700	Version r6305
Huawei S3000	Version r6305
Huawei S3300	Version r6305
Huawei S3300hi	Version r6305
Huawei S3500	Version r6305
Huawei S3700	Version r6305
Huawei S3900	Version r6305
Huawei S5100	Version r6305
Huawei S5600	Version r6305
Huawei S7800	Version r6305
Huawei S8500	Version r1631
Huawei S8500	Version r1632

Related CWEs

CWE-310

References (2)

http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-u_194371.htm

Source: cve@mitre.org

http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-u_194371.htm

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.