CVE-2016-6899 Weak cryptography in n/a

High 7.5 Published 7 Sep 2016 Updated 6 Aug 2024

Remote attackers can decrypt sensitive data by exploiting insecure SSL encryption algorithms in Huawei server BMCs.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2016-6899?

CVE-2016-6899 is a high-severity vulnerability in n/a, published on 7 Sep 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software before V100R003C00SPC617, RH2288H V3 servers with software before V100R003C00SPC515, RH5885 V3 servers with software before V100R003C10SPC102, and XH620 V3, XH622 V3, and XH628 V3 servers with software before V100R003C00SPC610 might allow remote attackers to decrypt encrypted data and consequently obtain sensitive information by leveraging selection of an insecure SSL encryption algorithm.

Weakness: CWE-310, CWE-200

Which versions are affected by CVE-2016-6899?

It affects 7 products.

Products include Huawei Rh1288 V3 Server Firmware, Huawei Rh2288 V3 Server Firmware, Huawei Rh2288h V3 Server Firmware, Huawei Rh5885 V3 Server Firmware, Huawei Xh620 V3 Server Firmware, Huawei Xh622 V3 Server Firmware and 1 more.

How do I fix CVE-2016-6899?

No fix has been published for CVE-2016-6899 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-6899 being exploited?

There is no known exploitation of CVE-2016-6899 in the wild and no public exploit code.

Sources

Also known as GHSA-w74p-5wrq-h9p9.