CVE-2016-6158

Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei WS331a routers with software before WS331a-10 V100R001C01B112 allow remote attackers to hijack the authentication of administrators for requests that (1) restore factory settings or (2) reboot the device via unspecified vectors.

CVSS v3 6.1 MEDIUM
CVSS v2.0 7.1 HIGH

6.1^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H

Exploitability : 0.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.1^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:H/Au:N/C:N/I:C/A:C

Exploitability : 4.9 / Impact : 9.2

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160907-01-ws331a-en	VDB Entry
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160907-01-ws331a-en	VDB Entry

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:huawei:ws331a_router_firmware:ws331a-10_v100r001c02b017sp01:*:*:*:*:*:*:*

cpe:2.3:h:huawei:ws331a_router:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2016-09-21 14:25

Updated : 2025-04-12 10:46

NVD link : CVE-2016-6158

Mitre link : CVE-2016-6158

CVE.ORG link : CVE-2016-6158

JSON object : View

Products Affected

huawei

ws331a_router
ws331a_router_firmware

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2016-6158", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "HIGH", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 9.2, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 0.9}]}, "published": "2016-09-21T14:25:17.457", "references": [{"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160907-01-ws331a-en", "tags": ["VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160907-01-ws331a-en", "tags": ["VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei WS331a routers with software before WS331a-10 V100R001C01B112 allow remote attackers to hijack the authentication of administrators for requests that (1) restore factory settings or (2) reboot the device via unspecified vectors."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de CSRF en routers Huawei WS331a con software en versiones anteriores a WS331a-10 V100R001C01B112 permiten a atacantes remotos secuestrar la autenticaci\u00f3n de administradores para peticiones que (1) restauran ajustes de fabrica o (2) reinician el dispositivo a trav\u00e9s de vectores no especificados."}], "lastModified": "2025-04-12T10:46:40.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:ws331a_router_firmware:ws331a-10_v100r001c02b017sp01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04E7212A-661D-4A3F-96A2-C80D6AF9A013"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:ws331a_router:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "616E58C3-6FA3-407E-8EFE-B91617FAC1A2"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}