VAR-201306-0366

Vulnerability from variot - Updated: 2025-04-11 22:53

Huawei Seco Versatile Security Manager (VSM) before V200R002C00SPC300 allows remote authenticated users to gain privileges via a certain change to a group configuration setting. Huawei Secospace VSM is a secure unified gateway device. The Huawei Secospace VSM lacks the correct verification check for modifying the default user group permissions, allowing the attacker to use the vulnerability to change the default user group permissions and enhance the permissions. Huawei VSM is a security service management system launched by China's Huawei for operators and enterprise customers. Huawei VSM Default User Groups ’has an elevation of privilege vulnerability. An attacker could use this vulnerability to bypass specific security restrictions and further elevate their permissions. This product can manage all of Huawei's security products, truly realizing "network security co-management". There is a vulnerability in Huawei Seco Versatile Security Manager (VSM) v200r002c00spc200 and earlier versions

Show details on source website

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201306-0366",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "seco versatile security manager",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "huawei",
        "version": "v200r002c00"
      },
      {
        "model": "seco versatile security manager",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "huawei",
        "version": "v200r002c00spc100"
      },
      {
        "model": "seco versatile security manager",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "huawei",
        "version": "v200r002c00spc200"
      },
      {
        "model": "secospace vsm v200r002c00",
        "scope": null,
        "trust": 0.6,
        "vendor": "huawei",
        "version": null
      },
      {
        "model": "secospace vsm v200r002c00spc100",
        "scope": null,
        "trust": 0.6,
        "vendor": "huawei",
        "version": null
      },
      {
        "model": "secospace vsm v200r002c00spc200",
        "scope": null,
        "trust": 0.6,
        "vendor": "huawei",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2013-02795"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003092"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201306-413"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-4633"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:huawei:seco_versatile_security_manager",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003092"
      }
    ]
  },
  "cve": "CVE-2013-4633",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "id": "CVE-2013-4633",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "SINGLE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.4,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 4.4,
            "id": "CNVD-2013-02795",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:A/AC:M/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "id": "VHN-64635",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2013-4633",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2013-4633",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2013-02795",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201306-413",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-64635",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2013-02795"
      },
      {
        "db": "VULHUB",
        "id": "VHN-64635"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003092"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201306-413"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-4633"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Huawei Seco Versatile Security Manager (VSM) before V200R002C00SPC300 allows remote authenticated users to gain privileges via a certain change to a group configuration setting. Huawei Secospace VSM is a secure unified gateway device. The Huawei Secospace VSM lacks the correct verification check for modifying the default user group permissions, allowing the attacker to use the vulnerability to change the default user group permissions and enhance the permissions. Huawei VSM is a security service management system launched by China\u0027s Huawei for operators and enterprise customers. \nHuawei VSM Default User Groups \u2019has an elevation of privilege vulnerability. An attacker could use this vulnerability to bypass specific security restrictions and further elevate their permissions. This product can manage all of Huawei\u0027s security products, truly realizing \"network security co-management\". There is a vulnerability in Huawei Seco Versatile Security Manager (VSM) v200r002c00spc200 and earlier versions",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2013-4633"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003092"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-02795"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201304-091"
      },
      {
        "db": "VULHUB",
        "id": "VHN-64635"
      }
    ],
    "trust": 2.79
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2013-4633",
        "trust": 2.5
      },
      {
        "db": "BID",
        "id": "58869",
        "trust": 1.3
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003092",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201306-413",
        "trust": 0.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2013-02795",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201304-091",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-64635",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2013-02795"
      },
      {
        "db": "VULHUB",
        "id": "VHN-64635"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003092"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201304-091"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201306-413"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-4633"
      }
    ]
  },
  "id": "VAR-201306-0366",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2013-02795"
      },
      {
        "db": "VULHUB",
        "id": "VHN-64635"
      }
    ],
    "trust": 1.7
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2013-02795"
      }
    ]
  },
  "last_update_date": "2025-04-11T22:53:18.563000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Huawei-SA-20130403-01-VSM",
        "trust": 0.8,
        "url": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-258449.htm"
      },
      {
        "title": "Huawei Secospace VSM default user group permission security bypass vulnerability patch",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/33164"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2013-02795"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003092"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-264",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-64635"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003092"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-4633"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.3,
        "url": "http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-258449.htm"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-4633"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-4633"
      },
      {
        "trust": 0.6,
        "url": "http://www.securityfocus.com/bid/58869"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2013-02795"
      },
      {
        "db": "VULHUB",
        "id": "VHN-64635"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003092"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201304-091"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201306-413"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-4633"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2013-02795"
      },
      {
        "db": "VULHUB",
        "id": "VHN-64635"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003092"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201304-091"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201306-413"
      },
      {
        "db": "NVD",
        "id": "CVE-2013-4633"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2013-04-09T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2013-02795"
      },
      {
        "date": "2013-06-20T00:00:00",
        "db": "VULHUB",
        "id": "VHN-64635"
      },
      {
        "date": "2013-06-24T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2013-003092"
      },
      {
        "date": "2013-04-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201304-091"
      },
      {
        "date": "2013-06-21T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201306-413"
      },
      {
        "date": "2013-06-20T15:55:01.123000",
        "db": "NVD",
        "id": "CVE-2013-4633"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2013-05-28T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2013-02795"
      },
      {
        "date": "2013-06-21T00:00:00",
        "db": "VULHUB",
        "id": "VHN-64635"
      },
      {
        "date": "2013-06-24T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2013-003092"
      },
      {
        "date": "2013-04-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201304-091"
      },
      {
        "date": "2013-06-28T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201306-413"
      },
      {
        "date": "2025-04-11T00:51:21.963000",
        "db": "NVD",
        "id": "CVE-2013-4633"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201304-091"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201306-413"
      }
    ],
    "trust": 1.2
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Huawei Seco Versatile Security Manager Vulnerability gained in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2013-003092"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "permissions and access control",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201306-413"
      }
    ],
    "trust": 0.6
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…