Huawei vulnerabilities
2,404 vulnerabilities
Known vulnerabilities in Huawei products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1,105 products.
Products
50 of 1,105- Harmonyos1,134 vulnerabilities
- Emui837 vulnerabilities
- Magic Ui276 vulnerabilities
- Secospace Usg660089 vulnerabilities
- Dp30087 vulnerabilities
- Te6083 vulnerabilities
- Usg950082 vulnerabilities
- Te3078 vulnerabilities
- Te5078 vulnerabilities
- Te4077 vulnerabilities
- Secospace Usg630067 vulnerabilities
- Secospace Usg650067 vulnerabilities
- Rp20065 vulnerabilities
- Nip660062 vulnerabilities
- Nip630060 vulnerabilities
- Nip680060 vulnerabilities
- Ngfw Module57 vulnerabilities
- Ips Module53 vulnerabilities
- Ar320052 vulnerabilities
- Ar120045 vulnerabilities
- S570045 vulnerabilities
- Ar20043 vulnerabilities
- P3043 vulnerabilities
- Ar16041 vulnerabilities
- Ar220041 vulnerabilities
- Ar120 S40 vulnerabilities
- Ar15040 vulnerabilities
- Ar1200 S39 vulnerabilities
- S770039 vulnerabilities
- Ar200 S38 vulnerabilities
- Ar2200 S38 vulnerabilities
- Srg130038 vulnerabilities
- Srg230038 vulnerabilities
- Srg330038 vulnerabilities
- Ar150 S37 vulnerabilities
- S670037 vulnerabilities
- Netengine16Ex36 vulnerabilities
- Viewpoint 903036 vulnerabilities
- Tp320635 vulnerabilities
- S970034 vulnerabilities
- Ar51033 vulnerabilities
- Tp310632 vulnerabilities
- Ar360031 vulnerabilities
- Mate 2031 vulnerabilities
- S1270030 vulnerabilities
- P30 Pro29 vulnerabilities
- Cloudengine 1280028 vulnerabilities
- Svn560028 vulnerabilities
- Svn580028 vulnerabilities
- Svn5800 C28 vulnerabilities
CVE-2026-65200huaweiopenbmc
EPSS score0.14%
The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An undersized response wraps the unsigned length difference to a very large value, and the parser then reads far past the response buffer. The affected code sits in the base (non-vendor) PLDM control class and the Huawei NCSI driver, so it is reachable for any PLDM endpoint or Huawei NIC on the internal management bus, unlike the vendor-specific wangxun parser tracked separately.CVE-2026-65199huaweiopenbmcEPSS score0.15%
openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete nine-privilege set for a `special_users` group that includes the `SNMPv1_v2c` pseudo-user.CVE-2026-65198huaweiopenubmcEPSS score0.19%
Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.CVE-2018-7935huaweie5573cs-322_firmwareEPSS score1.09%
There is a vulnerability in 21.328.01.00.00 version of the E5573Cs-322. Remote attackers could exploit this vulnerability to make the network where the E5573Cs-322 is running temporarily unavailable.CVE-2018-7956huawei technologies co., ltd.huawei vip app+4EPSS score0.76%
Huawei VIP App is a mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20. There is a vulnerability in versions before 4.0.5 that attackers can conduct bruteforce to the VIP App Web Services to get user information.CVE-2018-7991huawei technologies co., ltd.mate10+1EPSS score0.24%
Huawei smartphones Mate10 with versions earlier before ALP-AL00B 8.0.0.110(C00) have a Factory Reset Protection (FRP) bypass vulnerability. The system does not sufficiently verify the permission, an attacker uses a data cable to connect the smartphone to the computer and then perform some specific operations. Successful exploit could allow the attacker bypass the FRP protection to access the system setting page.CVE-2018-7932huaweiappgalleryEPSS score0.41%
Huawei AppGallery versions before 8.0.4.301 has an arbitrary Javascript running vulnerability. An attacker may set up a malicious network environment and trick user into accessing a malicious web page to bypass the whitelist mechanism, which make the malicious Javascript loaded and run in the smart phone.CVE-2018-7994huawei technologies co., ltd.ngfw module; nip6300; nip6600; nip6800; secospace usg6600; usg9500+7EPSS score0.96%
Some Huawei products IPS Module V500R001C50; NGFW Module V500R001C50; V500R002C10; NIP6300 V500R001C50; NIP6600 V500R001C50; NIP6800 V500R001C50; Secospace USG6600 V500R001C50; USG9500 V500R001C50 have a memory leak vulnerability. The software does not release allocated memory properly when processing Protal questionnaire. A remote attacker could send a lot questionnaires to the device, successful exploit could cause the device to reboot since running out of memory.CVE-2018-7957huawei technologies co., ltd.victoria-al00+1EPSS score0.21%
Huawei smartphones with software Victoria-AL00 8.0.0.336a(C00) have an information leakage vulnerability. Because an interface does not verify authorization correctly, attackers can exploit an application with the authorization of phone state to obtain user location additionally.CVE-2018-7923huawei technologies co., ltd.alp-l09+1EPSS score1.01%
Huawei ALP-L09 smart phones with versions earlier than ALP-L09 8.0.0.150(C432) have an insufficient input validation vulnerability due to lack of parameter check. An attacker tricks the user who has root privilege to install a crafted application, the application may modify the specific data to exploit the vulnerability. Successful exploit could allow the attacker to execute arbitrary code.CVE-2018-7925huawei technologies co., ltd.emily-al00a+1EPSS score0.25%
The radio module of some Huawei smartphones Emily-AL00A The versions before 8.1.0.171(C00) have a lock-screen bypass vulnerability. An unauthenticated attacker could start third-part input method APP through certain operations to bypass lock-screen by exploit this vulnerability.CVE-2018-7901huawei technologies co., ltd.alp-al00b, bla-al00b+2EPSS score0.46%
RCS module in Huawei ALP-AL00B smart phones with software versions earlier than 8.0.0.129, BLA-AL00B smart phones with software versions earlier than 8.0.0.129 has a remote control vulnerability. An attacker can trick a user to install a malicious application. When the application connects with RCS for the first time, it needs user to manually click to agree. In addition, the attacker needs to obtain the key that RCS uses to authenticate the application. Successful exploitation may cause the attacker to control keyboard remotely.CVE-2018-7947huawei technologies co., ltd.emily-al00a+1EPSS score0.24%
Huawei mobile phones with versions earlier before Emily-AL00A 8.1.0.153(C00) have an authentication bypass vulnerability. An attacker could trick the user to connect to a malicious device. In the debug mode, the malicious software in the device may exploit the vulnerability to bypass some specific function. Successful exploit may cause some malicious applications to be installed in the mobile phones.CVE-2018-7929huawei technologies co., ltd.mate rs+1EPSS score0.24%
Huawei Mate RS smartphones with the versions before NEO-AL00D 8.1.0.167(C786) have a lock-screen bypass vulnerability. An attacker could unlock and use the phone through certain operations.CVE-2018-7949huawei1288h_v5_firmware+19EPSS score0.82%
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specially crafted login messages to the affected products. Due to improper authentication design, successful exploit enables low privileged users to get or modify passwords of highly privileged users.CVE-2018-7960huawei technologies co., ltd.espace 7950+1EPSS score0.78%
There is a SRTP icon display vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to intercept the packets in non-secure transmission mode. Successful exploitation may intercept and tamper with the call information, eventually cause sensitive information leak.CVE-2018-7990huawei technologies co., ltd.mate10 pro+1EPSS score0.24%
Mate10 Pro Huawei smart phones with the versions before 8.1.0.326(C00) have a FRP bypass vulnerability. During the mobile phone reseting process, an attacker could bypass "Find My Phone" protect after a series of voice and keyboard operations. Successful exploit could allow an attacker to bypass FRP.CVE-2018-7958huawei technologies co., ltd.espace 7950+1EPSS score1.11%
There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to hijack the connection from a client when the user signs up to log in by TLS. Due to insufficient authentication, which may be exploited to intercept and tamper with the data information.CVE-2018-7959huawei technologies co., ltd.espace 7950+1EPSS score0.78%
There is a short key vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to intercept and decrypt the call information when the user enables SRTP to make a call. Successful exploitation may cause sensitive information leak.CVE-2018-7903huawei technologies co., ltd.1288h v5; 2288h v5+2EPSS score1.11%
Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management privilege of the system.