CVE-2016-6670

CWE-200 — Information Exposure3 documents3 sources

Severity

5.3MEDIUM

EPSS

0.1%

top 83.33%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Huawei S7700 Firmware Huawei S9300 Firmware Huawei S9700 Firmware +1 more

Timeline

PublishedSep 7

Latest updateMay 17

Description

Huawei S7700, S9300, S9700, and S12700 devices with software before V200R008C00SPC500 use random numbers with insufficient entropy to generate self-signed certificates, which makes it easier for remote attackers to discover private keys by leveraging knowledge of a certificate.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶NVDhuawei/s7700_firmwarev200r003c00, v200r005c00+1

▶NVDhuawei/s9300_firmwarev200r003c00, v200r005c00+1

▶NVDhuawei/s9700_firmwarev200r003c00, v200r005c00+1

▶NVDhuawei_firmware/s12700v200r005c00

🔴Vulnerability Details

GHSA

GHSA-hhfp-v3gq-7x69: Huawei S7700, S9300, S9700, and S12700 devices with software before V200R008C00SPC500 use random numbers with insufficient entropy to generate self-si↗2022-05-17

▶

CVEList

CVE-2016-6670: Huawei S7700, S9300, S9700, and S12700 devices with software before V200R008C00SPC500 use random numbers with insufficient entropy to generate self-si↗2016-09-07

▶