Search
Find a vulnerability
Search criteria
4 vulnerabilities found for GR-1100-P by H3C
CVE-2024-42639 (GCVE-0-2024-42639)
Vulnerability from nvd – Published: 2024-08-16 00:00 – Updated: 2025-03-20 13:33
VLAI
EPSS
VEX
Summary
H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-19 17:26 UTC
CWE
- n/a
- CWE-259 - Use of Hard-coded Password
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:h3c:gr-1100-p:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gr-1100-p",
"vendor": "h3c",
"versions": [
{
"status": "affected",
"version": "v100R009"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-42639",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-19T17:26:24.566832Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "CWE-259 Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-20T13:33:38.169Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-16T18:00:18.489Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://palm-vertebra-fe9.notion.site/H3C-GR1100-PV100R009-was-discovered-to-contain-a-hardcoded-824141daa44f4c52a914860c6e4a7684"
},
{
"url": "https://www.h3c.com/cn/d_202308/1912371_30005_0.htm"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-42639",
"datePublished": "2024-08-16T00:00:00.000Z",
"dateReserved": "2024-08-05T00:00:00.000Z",
"dateUpdated": "2025-03-20T13:33:38.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5142 (GCVE-0-2023-5142)
Vulnerability from nvd – Published: 2023-09-24 22:00 – Updated: 2024-08-02 07:52
VLAI
EPSS
VEX
Title
H3C ER6300G2 Config File userLogin.asp path traversal
Summary
A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 up to 20230908. This vulnerability affects unknown code of the file /userLogin.asp of the component Config File Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-240238 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CWE
- CWE-22 - Path Traversal
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.240238 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.240238 | signaturepermissions-required |
| https://github.com/yinsel/CVE-H3C-Report | broken-linkexploit |
| https://github.com/CJCniubi666/H3C-ER/blob/main/R… | related |
Impacted products
15 products
| Vendor | Product | Version | |
|---|---|---|---|
| H3C | GR-1100-P |
Affected:
20230908
|
|
| H3C | GR-1108-P |
Affected:
20230908
|
|
| H3C | GR-1200W |
Affected:
20230908
|
|
| H3C | GR-1800AX |
Affected:
20230908
|
|
| H3C | GR-2200 |
Affected:
20230908
|
|
| H3C | GR-3200 |
Affected:
20230908
|
|
| H3C | GR-5200 |
Affected:
20230908
|
|
| H3C | GR-8300 |
Affected:
20230908
|
|
| H3C | ER2100n |
Affected:
20230908
|
|
| H3C | ER2200G2 |
Affected:
20230908
|
|
| H3C | ER3200G2 |
Affected:
20230908
|
|
| H3C | ER3260G2 |
Affected:
20230908
|
|
| H3C | ER5100G2 |
Affected:
20230908
|
|
| H3C | ER5200G2 |
Affected:
20230908
|
|
| H3C | ER6300G2 |
Affected:
20230908
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:52:07.533Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.240238"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.240238"
},
{
"tags": [
"broken-link",
"exploit",
"x_transferred"
],
"url": "https://github.com/yinsel/CVE-H3C-Report"
},
{
"tags": [
"related",
"x_transferred"
],
"url": "https://github.com/CJCniubi666/H3C-ER/blob/main/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"modules": [
"Config File Handler"
],
"product": "GR-1100-P",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "GR-1108-P",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "GR-1200W",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "GR-1800AX",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "GR-2200",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "GR-3200",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "GR-5200",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "GR-8300",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "ER2100n",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "ER2200G2",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "ER3200G2",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "ER3260G2",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "ER5100G2",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "ER5200G2",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "ER6300G2",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yinsel975 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 up to 20230908. This vulnerability affects unknown code of the file /userLogin.asp of the component Config File Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-240238 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "In H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 bis 20230908 wurde eine Schwachstelle entdeckt. Sie wurde als problematisch eingestuft. Dabei geht es um eine nicht genauer bekannte Funktion der Datei /userLogin.asp der Komponente Config File Handler. Durch das Beeinflussen mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Das Ausnutzen gilt als schwierig. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-13T08:03:35.039Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.240238"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.240238"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "https://github.com/yinsel/CVE-H3C-Report"
},
{
"tags": [
"related"
],
"url": "https://github.com/CJCniubi666/H3C-ER/blob/main/README.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-09-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-09-24T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-09-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-10-14T17:43:30.000Z",
"value": "VulDB entry last update"
}
],
"title": "H3C ER6300G2 Config File userLogin.asp path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2023-5142",
"datePublished": "2023-09-24T22:00:06.432Z",
"dateReserved": "2023-09-24T14:06:15.230Z",
"dateUpdated": "2024-08-02T07:52:07.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42639 (GCVE-0-2024-42639)
Vulnerability from cvelistv5 – Published: 2024-08-16 00:00 – Updated: 2025-03-20 13:33
VLAI
EPSS
VEX
Summary
H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-19 17:26 UTC
CWE
- n/a
- CWE-259 - Use of Hard-coded Password
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:h3c:gr-1100-p:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "gr-1100-p",
"vendor": "h3c",
"versions": [
{
"status": "affected",
"version": "v100R009"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-42639",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-19T17:26:24.566832Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "CWE-259 Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-20T13:33:38.169Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-16T18:00:18.489Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://palm-vertebra-fe9.notion.site/H3C-GR1100-PV100R009-was-discovered-to-contain-a-hardcoded-824141daa44f4c52a914860c6e4a7684"
},
{
"url": "https://www.h3c.com/cn/d_202308/1912371_30005_0.htm"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-42639",
"datePublished": "2024-08-16T00:00:00.000Z",
"dateReserved": "2024-08-05T00:00:00.000Z",
"dateUpdated": "2025-03-20T13:33:38.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5142 (GCVE-0-2023-5142)
Vulnerability from cvelistv5 – Published: 2023-09-24 22:00 – Updated: 2024-08-02 07:52
VLAI
EPSS
VEX
Title
H3C ER6300G2 Config File userLogin.asp path traversal
Summary
A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 up to 20230908. This vulnerability affects unknown code of the file /userLogin.asp of the component Config File Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-240238 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity
CWE
- CWE-22 - Path Traversal
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.240238 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.240238 | signaturepermissions-required |
| https://github.com/yinsel/CVE-H3C-Report | broken-linkexploit |
| https://github.com/CJCniubi666/H3C-ER/blob/main/R… | related |
Impacted products
15 products
| Vendor | Product | Version | |
|---|---|---|---|
| H3C | GR-1100-P |
Affected:
20230908
|
|
| H3C | GR-1108-P |
Affected:
20230908
|
|
| H3C | GR-1200W |
Affected:
20230908
|
|
| H3C | GR-1800AX |
Affected:
20230908
|
|
| H3C | GR-2200 |
Affected:
20230908
|
|
| H3C | GR-3200 |
Affected:
20230908
|
|
| H3C | GR-5200 |
Affected:
20230908
|
|
| H3C | GR-8300 |
Affected:
20230908
|
|
| H3C | ER2100n |
Affected:
20230908
|
|
| H3C | ER2200G2 |
Affected:
20230908
|
|
| H3C | ER3200G2 |
Affected:
20230908
|
|
| H3C | ER3260G2 |
Affected:
20230908
|
|
| H3C | ER5100G2 |
Affected:
20230908
|
|
| H3C | ER5200G2 |
Affected:
20230908
|
|
| H3C | ER6300G2 |
Affected:
20230908
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:52:07.533Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.240238"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.240238"
},
{
"tags": [
"broken-link",
"exploit",
"x_transferred"
],
"url": "https://github.com/yinsel/CVE-H3C-Report"
},
{
"tags": [
"related",
"x_transferred"
],
"url": "https://github.com/CJCniubi666/H3C-ER/blob/main/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"modules": [
"Config File Handler"
],
"product": "GR-1100-P",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "GR-1108-P",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "GR-1200W",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "GR-1800AX",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "GR-2200",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "GR-3200",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "GR-5200",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "GR-8300",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "ER2100n",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "ER2200G2",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "ER3200G2",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "ER3260G2",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "ER5100G2",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "ER5200G2",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
},
{
"modules": [
"Config File Handler"
],
"product": "ER6300G2",
"vendor": "H3C",
"versions": [
{
"status": "affected",
"version": "20230908"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yinsel975 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 up to 20230908. This vulnerability affects unknown code of the file /userLogin.asp of the component Config File Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-240238 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "In H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 bis 20230908 wurde eine Schwachstelle entdeckt. Sie wurde als problematisch eingestuft. Dabei geht es um eine nicht genauer bekannte Funktion der Datei /userLogin.asp der Komponente Config File Handler. Durch das Beeinflussen mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Das Ausnutzen gilt als schwierig. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-13T08:03:35.039Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.240238"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.240238"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "https://github.com/yinsel/CVE-H3C-Report"
},
{
"tags": [
"related"
],
"url": "https://github.com/CJCniubi666/H3C-ER/blob/main/README.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-09-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-09-24T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-09-24T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-10-14T17:43:30.000Z",
"value": "VulDB entry last update"
}
],
"title": "H3C ER6300G2 Config File userLogin.asp path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2023-5142",
"datePublished": "2023-09-24T22:00:06.432Z",
"dateReserved": "2023-09-24T14:06:15.230Z",
"dateUpdated": "2024-08-02T07:52:07.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}