Vulnerability CVE-2012-3268
Published: 2013-02-01

Description:
Certain HP Access Controller, Fabric Module, Firewall, Router, Switch, and UTM Appliance products; certain HP 3Com Access Controller, Router, and Switch products; certain HP H3C Access Controller, Firewall, Router, Switch, and Switch and Route Processing Unit products; and certain Huawei Firewall/Gateway, Router, Switch, and Wireless products do not properly implement access control as defined in h3c-user.mib 2.0 and hh3c-user.mib 2.0, which allows remote authenticated users to discover credentials in UserInfoEntry values via an SNMP request with the read-only community.

See advisories in our WLB2 database:
Topic
Author
Date
High
HP/H3C and Huawei SNMP Weak Access to Critical Data
Kurt Grutzmacher
24.10.2012

Type:

CWE-200

 (Information Exposure)

CVSS2 => (AV:N/AC:M/Au:S/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
8.5/10
10/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Huawei -> ATB 
Huawei -> Ma5200g 
Huawei -> Ne40&80 
Huawei -> Ne5000e 
Huawei -> Ne20e-x6 
Huawei -> -ma5200g 
Huawei -> NE20 
Huawei -> Cx600 
Huawei -> Ne40e&80e 
Huawei -> ME60 
Huawei -> ATN 
HP -> S3100-8c-si-model ls-s3100-8c-si-dc-ovs 
HP -> A5120-24g ei switch 
HP -> 3600-48-poe+ v2 ei switch 
HP -> S3610-28f-model ls-3610-28f-ovs 
HP -> A6608 router bundle with rpe-x1 modules and power supply 
HP -> 4200g switch 24-port 
HP -> S5100-8p-pwr-ei-model ls-5100-8p-pwr-ei-ovs 
HP -> A8808 router chassis 
HP -> 4210 switch 52-port 
HP -> E4200-48 si switch 
HP -> 4500g pwr switch 24-port 
HP -> S7503e ethernet switch chassis with fan 
HP -> E4500-48g switch 
HP -> 4800g pwr switch 24-port 
HP -> A9512w chassis w/ fans 
HP -> E5500-24g switch 
HP -> 5232 router 
HP -> Taa 5500-ei pwr switch 52-port 
HP -> F1000-e vpn firewall 
HP -> 5500-48g-poe+ ei taa-compliant switch with 2 interface slots 
HP -> Sw8814 ac chassis kit taa 
HP -> Msr20-15-a router 
HP -> 5500g-ei switch 48-port 
HP -> Msr 30-10 router host (ac) 2fe 2sic 1xmim 256ddr 
HP -> 5800af-48g switch 
HP -> Msr 3040 vcx cpm t1/4fxo/4fxs bundle 
HP -> 6616 router chassis 
HP -> Msr30-10 router 
HP -> 8800 firewall processing module 
HP -> Msr30-40 router with vcx and t1 and 4-port fxo and 4-port fxs modules 
HP -> 9508-v switch chassis 
HP -> Msr920 router 
HP -> A-u200-s unified threat management appliance 
HP -> 1910-24g-poe (365w) switch 
HP -> Rt-msr3020-ac-poe-ovs-h3 
HP -> A3100-26c-epon-ei switch 
HP -> 3041 router 
HP -> S12518 (ac-1) routing switch 
HP -> A3610-48 switch 
HP -> 3100-8-poe ei switch 
HP -> S3100-8t-si-model ls-s3100-8t-si-ac-ovs 
HP -> A5120-24g ei switch with 2 interface slots 
HP -> 3600-48-poe+ v2 si switch 
HP -> S3610-28p-model ls-3610-28p-ovs 
HP -> A6616 router chassis 
HP -> 4200g switch 48-port 
HP -> S5100-8p-si-model ls-5100-8p-si-ovs-h3 
HP -> A8812 router chassis 
HP -> 4210 switch 9-port 
HP -> E4200-48g switch 
HP -> 4500g pwr switch 24-port taa 
HP -> Ss4 5500g-ei switch 24pt (no psu) 
HP -> E4510-24g switch 
HP -> 4800g pwr switch 48-port 
HP -> Ss4 5500g-ei 24 port sfp (no psu) 
HP -> E5500-48-poe ei (taa) switch 
HP -> 5500-24g-4sfp hi switch with 2 interface slots 
HP -> Taa compliant 5500g-ei pwr 48p 
HP -> F1000-ei vpn firewall appliance 
HP -> 5500-48g-poe+ si switch with 2 interface slots 
HP -> S9512e routing-switch chassis 
HP -> Msr20-15 router 
HP -> 5500g-ei switch pwr 24-port3cr17252-91 
HP -> Msr 30-16 
HP -> 5810-48g switch 
HP -> Msr 3040 vcx ent mim bundle 
HP -> 7500 384gbps fabric module 
HP -> Msr30-11 router 
HP -> 8802 router chassis 
HP -> Msr30-60 dc router 
HP -> 9512 switch chassis 
HP -> Rt-msr2011-ac-ovs-h3 
HP -> A-wx5002 access controller 
HP -> 1910-24g switch 
HP -> Rt-msr3020-dc-ovs-h3 
HP -> A3100-8 si 1-slot switch 
HP -> 3100-16-poe ei switch 
HP -> S12518 chassis 
HP -> A5100-16g-poe ei switch 
HP -> 3100-8 dc ei switch 
HP -> S3100-8tp-ei-model ls-3100-8tp-ei-h3-a-o 
HP -> A5120-48g-poe ei 2-slot switch 
HP -> 3600-48-poe ei switch 
HP -> S3610-28tp-model ls-3610-28tp-ovs 
HP -> A7500 384gbps fabric/main processing unit 
HP -> 4200g switch pwr 24-port 
HP -> S5120-20p-si l2 16ge plus 4sfp 
HP -> A9505 switch chassis 
HP -> 4210 switch 9-port taa 

 References:
http://archives.neohapsis.com/archives/bugtraq/2012-10/0123.html
http://grutztopia.jingojango.net/2012/10/hph3c-and-huawei-snmp-weak-access-to.html
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03515685
http://support.huawei.com/enterprise/NewsReadAction.action?newType=0301&contentId=NEWS1000001165&idAbsPath=0301_10001&nameAbsPath=Services%2520News
http://www.kb.cert.org/vuls/id/225404
http://www.kb.cert.org/vuls/id/MORO-8ZDJDP
http://www.securityfocus.com/bid/56183
http://www.securitytracker.com/id?1027694
Copyright 2026, cxsecurity.com

 

Back to Top