CVE-2014-9137 Huawei USG9500 with software V200R001C01SPC800 and earlier versions, V300R001C00; USG2100 with software V300R001C00SPC900 and earlier versions; USG2200 with software V300R001C00SPC900; USG5100 with so...

HighCVSS 8.8 EPSS 0.40%

Published: 2017-04-02 23:00
Updated: 2026-06-17 03:17
Exploit status: No public exploit known

Description

Huawei USG9500 with software V200R001C01SPC800 and earlier versions, V300R001C00; USG2100 with software V300R001C00SPC900 and earlier versions; USG2200 with software V300R001C00SPC900; USG5100 with software V300R001C00SPC900 could allow an unauthenticated, remote attacker to conduct a CSRF attack against the user of the web interface.

Affected products

Product	Affected versions	Fixed in
Huawei fusionmanager	= v100r002c03	No fix listed
Huawei fusionmanager	= v100r003c00	No fix listed
Huawei usg9500 firmware	<= v200r001c01spc800	No fix listed
Huawei usg9500 firmware	= v300r001c00	No fix listed
Huawei usg2100 firmware	<= v300r001c00spc900	No fix listed
Huawei usg2200 firmware	<= v300r001c00spc900	No fix listed
Huawei usg5100 firmware	<= v300r001c00spc900	No fix listed
Huawei usg5500 firmware	<= v300r001c00spc900	No fix listed

References

www.huawei.com vendor-advisory

CVSS v3.0

8.8 High

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

All scores (2)

v3.0 8.8 · nvd@nist.gov
v2.0 6.8 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.40% (percentile 35.1)
CWE: CWE-352

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.