CVE-2014-5395 Cross-site request forgery in n/a
Remote attackers can hijack user sessions to modify device configurations or send SMS messages via CSRF attacks on Huawei mobile hotspots.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2014-5395?
CVE-2014-5395 is a medium-severity vulnerability in n/a, published on 21 Nov 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users for requests that (1) modify configurations, (2) send SMS messages, or have other unspecified impact via unknown vectors.
Weakness: CWE-352
Which versions are affected by CVE-2014-5395?
It affects 4 products.
Products include Huawei E3236 Firmware, Huawei E3276 Firmware, Huawei E5180s-22 Firmware, Huawei E586bs-2 Firmware.
How do I fix CVE-2014-5395?
No fix has been published for CVE-2014-5395 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-5395 being exploited?
There is no known exploitation of CVE-2014-5395 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-x8fx-7cvv-6463.