CVE-2015-8086: huawei ar_firmware Inadequate Encryption Strength

Vulnerability summary

CVE-2015-8086 is a medium (CVSS 4.9) Inadequate Encryption Strength vulnerability in huawei ar_firmware. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.2% of scored vulnerabilities.

Timeline

1. 03-10-2016
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Huawei AR routers with software before V200R007C00SPC100; Quidway S9300 routers with software before V200R009C00; S12700 routers with software before V200R008C00SPC500; S9300, Quidway S5300, and S5300 routers with software before V200R007C00; and S5700 routers with software before V200R007C00SPC500 makes it easier for remote authenticated administrators to obtain encryption keys and ciphertext passwords via vectors related to key storage.

• CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.