Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603…
Priority LOW 33CWE-275Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allow remote authenticated operators to change server information by leveraging failure to verify user permissions.
Why it matters now
EPSS 0.00744 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:rh2288_v3_firmware:*:*:*:*:*:*:*:* | up to v100r003c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:rh2288_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:rh2288h_v3_firmware:*:*:*:*:*:*:*:* | up to v100r003c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:rh2288h_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:xh628_v3_firmware:*:*:*:*:*:*:*:* | up to v100r003c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:xh628_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:rh1288_v3_firmware:*:*:*:*:*:*:*:* | up to v100r003c00spc100 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:rh1288_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:rh2288a_v2_firmware:*:*:*:*:*:*:*:* | up to v100r002c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:rh2288a_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:huawei:rh2288_v3_firmware:*:*:*:*:*:*:*:* Versions up to v100r003c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:rh2288_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:rh2288h_v3_firmware:*:*:*:*:*:*:*:* Versions up to v100r003c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:rh2288h_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:xh628_v3_firmware:*:*:*:*:*:*:*:* Versions up to v100r003c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:xh628_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:rh1288_v3_firmware:*:*:*:*:*:*:*:* Versions up to v100r003c00spc100 Vulnerable ·Huawei
- cpe:2.3:h:huawei:rh1288_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:rh2288a_v2_firmware:*:*:*:*:*:*:*:* Versions up to v100r002c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:rh2288a_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:rh1288a_v2_firmware:*:*:*:*:*:*:*:* | up to v100r002c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:rh1288a_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:rh8100_v3_firmware:*:*:*:*:*:*:*:* | up to v100r003c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:rh8100_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:ch222_v3_firmware:*:*:*:*:*:*:*:* | up to v100r001c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:ch222_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:ch220_v3_firmware:*:*:*:*:*:*:*:* | up to v100r001c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:ch220_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:ch121_v3_firmware:*:*:*:*:*:*:*:* | up to v100r001c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:ch121_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:huawei:rh1288a_v2_firmware:*:*:*:*:*:*:*:* Versions up to v100r002c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:rh1288a_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:rh8100_v3_firmware:*:*:*:*:*:*:*:* Versions up to v100r003c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:rh8100_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:ch222_v3_firmware:*:*:*:*:*:*:*:* Versions up to v100r001c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:ch222_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:ch220_v3_firmware:*:*:*:*:*:*:*:* Versions up to v100r001c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:ch220_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:ch121_v3_firmware:*:*:*:*:*:*:*:* Versions up to v100r001c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:ch121_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2015-7842
- 2026-10-03 Alias added: GHSA-2rgr-q9rf-5jv3
References
More Huawei Ch121 V3 Firmware vulnerabilities
- TI-2018-05755 Code injection in Huawei 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5… CVSS 3.0HIGH 8.8
- TI-2018-05754 Code injection in Huawei 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5… CVSS 3.0HIGH 8.8
- TI-2018-05749 Improper authentication in Huawei 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3… CVSS 3.0HIGH 8.8
- TI-2018-05753 Improper authentication in Huawei 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3… CVSS 3.0HIGH 8.8
- TI-2018-05747 Improper authentication in Huawei iBMC CVSS 3.0HIGH 8.8
- TI-2018-05748 The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have an… CVSS 3.0HIGH 7.5
Sources
- CVE-2015-7842 · CVE Program
- CVE-2015-7842 · NVD
- FIRST EPSS
- GHSA-2rgr-q9rf-5jv3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences