CVE-2018-7958 Security feature bypass in eSpace 7950
An attacker can intercept and tamper with login data via a man-in-the-middle attack due to weak TLS cipher suite support in Huawei eSpace devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7958?
CVE-2018-7958 is a high-severity vulnerability in Huawei Technologies Co., Ltd. eSpace 7950, published on 27 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in-the-middle attack to hijack the connection from a client when the user signs up to log in by TLS. Due to insufficient authentication, which may be exploited to intercept and tamper with the data information.
Weakness: CWE-287
Which versions are affected by CVE-2018-7958?
It affects 1 product.
Products include Huawei Espace 7950 Firmware.
How do I fix CVE-2018-7958?
No fix has been published for CVE-2018-7958 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-7958 being exploited?
There is no known exploitation of CVE-2018-7958 in the wild and no public exploit code.
Other vulnerabilities in Huawei Technologies Co., Ltd. eSpace 7950
Sources
Also known as GHSA-jjfx-7737-h7g7.