CVE-2014-0337

Published: Apr 5, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the web interface on Huawei Echo Life HG8247 routers with software before V100R006C00SPC127 allows remote attackers to inject arbitrary web script or HTML via an invalid TELNET connection attempt with a crafted username that is not properly handled during construction of the "failed log-in attempts over telnet" log view.

Affected (2)

Products: Huawei: Echo Life Hg8247 Firmware, Echo Life

2 products

Echo Life Hg8247 Firmware

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Huawei Echo Life Hg8247 Firmware	Version v1r006c00s120
Huawei Echo Life	Version hg8247

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

http://www.kb.cert.org/vuls/id/917700

Source: cret@cert.org

US Government Resource

http://www.kb.cert.org/vuls/id/917700

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

Timeline

No history available yet.