The login page of the server on Huawei FusionServer rack servers RH2288 V3 with software…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-77.
Summary
The login page of the server on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allows remote attackers to bypass access restrictions and enter commands via unspecified parameters, as demonstrated by a "user creation command."
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:huawei:fusionserver_ch121_v3:v100r001c00:*:*:*:*:*:*:* | v100r001c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_ch220_v3:v100r001c00:*:*:*:*:*:*:* | v100r001c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_ch222_v3:v100r001c00:*:*:*:*:*:*:* | v100r001c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_rh1288_v3:v100r003c00spc100:*:*:*:*:*:*:* | v100r003c00spc100 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_rh1288a_v2:v100r002c00:*:*:*:*:*:*:* | v100r002c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_rh2288_v3:v100r003c00:*:*:*:*:*:*:* | v100r003c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_rh2288a_v2:v100r002c00:*:*:*:*:*:*:* | v100r002c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_rh2288h_v3:v100r003c00:*:*:*:*:*:*:* | v100r003c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_rh8100_v3:v100r003c00:*:*:*:*:*:*:* | v100r003c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_xh628_v3:v100r003c00:*:*:*:*:*:*:* | v100r003c00 | Vulnerable | Huawei |
- cpe:2.3:a:huawei:fusionserver_ch121_v3:v100r001c00:*:*:*:*:*:*:* Versions v100r001c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_ch220_v3:v100r001c00:*:*:*:*:*:*:* Versions v100r001c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_ch222_v3:v100r001c00:*:*:*:*:*:*:* Versions v100r001c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_rh1288_v3:v100r003c00spc100:*:*:*:*:*:*:* Versions v100r003c00spc100 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_rh1288a_v2:v100r002c00:*:*:*:*:*:*:* Versions v100r002c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_rh2288_v3:v100r003c00:*:*:*:*:*:*:* Versions v100r003c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_rh2288a_v2:v100r002c00:*:*:*:*:*:*:* Versions v100r002c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_rh2288h_v3:v100r003c00:*:*:*:*:*:*:* Versions v100r003c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_rh8100_v3:v100r003c00:*:*:*:*:*:*:* Versions v100r003c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_xh628_v3:v100r003c00:*:*:*:*:*:*:* Versions v100r003c00 Vulnerable ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2015-7841
- 2026-10-03 Alias added: GHSA-f36j-q56c-jw5x
References
More Huawei Fusionserver Ch121 V3 vulnerabilities
- TI-2015-06517 The management interface on Huawei FusionServer rack servers RH2288 V3 with software… CVSS 3.0HIGH 8.8
Sources
- CVE-2015-7841 · CVE Program
- CVE-2015-7841 · NVD
- FIRST EPSS
- GHSA-f36j-q56c-jw5x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences