First published: Tue Mar 11 2014(Updated: )
The Huawei E355 adapter with firmware 21.157.37.01.910 does not require authentication for API pages, which allows remote attackers to change passwords and settings, or obtain sensitive information, via a direct request to (1) api/wlan/security-settings, (2) api/device/information, (3) api/wlan/basic-settings, (4) api/wlan/mac-filter, (5) api/monitoring/status, or (6) api/dhcp/settings.
Credit: cret@cert.org
Affected Software | Affected Version | How to fix |
---|---|---|
Huawei E355s Mobile Wifi Firmware | =21.157.37.01.910 | |
Huawei E355 Firmware | ||
All of | ||
Huawei E355s Mobile Wifi Firmware | =21.157.37.01.910 | |
Huawei E355 Firmware |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2013-6031 has a medium severity score due to the lack of authentication on API pages of the Huawei E355 adapter.
To fix CVE-2013-6031, update the Huawei E355 adapter firmware to the latest version that addresses this vulnerability.
The consequences of CVE-2013-6031 include potential unauthorized access to change settings and steal sensitive information from the Huawei E355 adapter.
Users of the Huawei E355 adapter running firmware version 21.157.37.01.910 are affected by CVE-2013-6031.
Yes, CVE-2013-6031 can be exploited remotely since it allows attackers to access API endpoints without authentication.