8.8

CVE-2014-9137

Huawei USG9500 with software V200R001C01SPC800 and earlier versions, V300R001C00; USG2100 with software V300R001C00SPC900 and earlier versions; USG2200 with software V300R001C00SPC900; USG5100 with software V300R001C00SPC900 could allow an unauthenticated, remote attacker to conduct a CSRF attack against the user of the web interface.

Data is provided by the National Vulnerability Database (NVD)
Huawei ≫ Fusionmanager Versionv100r002c03
Huawei ≫ Fusionmanager Versionv100r003c00
Huawei ≫ Usg9500 Firmware Version <= v200r001c01spc800
   Huawei ≫ Usg9500 Version-
Huawei ≫ Usg9500 Firmware Versionv300r001c00
   Huawei ≫ Usg9500 Version-
Huawei ≫ Usg2100 Firmware Version <= v300r001c00spc900
   Huawei ≫ Usg2100 Version-
Huawei ≫ Usg2200 Firmware Version <= v300r001c00spc900
   Huawei ≫ Usg2200 Version-
Huawei ≫ Usg5100 Firmware Version <= v300r001c00spc900
   Huawei ≫ Usg5100 Version-
Huawei ≫ Usg5500 Firmware Version <= v300r001c00spc900
   Huawei ≫ Usg5500 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.09% 0.228
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.