CVE-2014-9137 Cross-site request forgery in USG9500,USG2100,USG2200,USG5100,USG5500, USG9500 V200R001C01SPC800 and earlier versions, All V300R001C00 versions,USG2100 V300R001C00SPC900 and earlier versions,USG2200 V300R001C00SPC900,USG5100 V300R001C00SPC900,
An unauthenticated remote attacker can perform CSRF attacks against the web interface of Huawei USG firewalls, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2014-9137?
CVE-2014-9137 is a high-severity vulnerability in Huawei Usg9500 Firmware, published on 2 Apr 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Huawei USG9500 with software V200R001C01SPC800 and earlier versions, V300R001C00; USG2100 with software V300R001C00SPC900 and earlier versions; USG2200 with software V300R001C00SPC900; USG5100 with software V300R001C00SPC900 could allow an unauthenticated, remote attacker to conduct a CSRF attack against the user of the web interface.
Weakness: CWE-352
Which versions are affected by CVE-2014-9137?
It affects 6 products.
Products include Huawei Fusionmanager, Huawei Usg2100 Firmware, Huawei Usg2200 Firmware, Huawei Usg5100 Firmware, Huawei Usg5500 Firmware, Huawei Usg9500 Firmware.
How do I fix CVE-2014-9137?
No fix has been published for CVE-2014-9137 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-9137 being exploited?
There is no known exploitation of CVE-2014-9137 in the wild and no public exploit code.
Other vulnerabilities in Huawei Usg9500 Firmware
Sources
Also known as GHSA-8753-fcrc-w2vr.