The management interface on Huawei FusionServer rack servers RH2288 V3 with software…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
The management interface on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 does not limit the number of query attempts, which allows remote authenticated users to obtain credentials of higher-level users via a brute force attack.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:huawei:fusionserver_ch121_v3:v100r001c00:*:*:*:*:*:*:* | v100r001c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_ch220_v3:v100r001c00:*:*:*:*:*:*:* | v100r001c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_ch222_v3:v100r001c00:*:*:*:*:*:*:* | v100r001c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_rh1288_v3:v100r003c00spc100:*:*:*:*:*:*:* | v100r003c00spc100 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_rh1288a_v2:v100r002c00:*:*:*:*:*:*:* | v100r002c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_rh2288_v3:v100r003c00:*:*:*:*:*:*:* | v100r003c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_rh2288a_v2:v100r002c00:*:*:*:*:*:*:* | v100r002c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_rh2288h_v3:v100r003c00:*:*:*:*:*:*:* | v100r003c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_rh8100_v3:v100r003c00:*:*:*:*:*:*:* | v100r003c00 | Vulnerable | Huawei |
| cpe:2.3:a:huawei:fusionserver_xh628_v3:v100r003c00:*:*:*:*:*:*:* | v100r003c00 | Vulnerable | Huawei |
- cpe:2.3:a:huawei:fusionserver_ch121_v3:v100r001c00:*:*:*:*:*:*:* Versions v100r001c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_ch220_v3:v100r001c00:*:*:*:*:*:*:* Versions v100r001c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_ch222_v3:v100r001c00:*:*:*:*:*:*:* Versions v100r001c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_rh1288_v3:v100r003c00spc100:*:*:*:*:*:*:* Versions v100r003c00spc100 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_rh1288a_v2:v100r002c00:*:*:*:*:*:*:* Versions v100r002c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_rh2288_v3:v100r003c00:*:*:*:*:*:*:* Versions v100r003c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_rh2288a_v2:v100r002c00:*:*:*:*:*:*:* Versions v100r002c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_rh2288h_v3:v100r003c00:*:*:*:*:*:*:* Versions v100r003c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_rh8100_v3:v100r003c00:*:*:*:*:*:*:* Versions v100r003c00 Vulnerable ·Huawei
- cpe:2.3:a:huawei:fusionserver_xh628_v3:v100r003c00:*:*:*:*:*:*:* Versions v100r003c00 Vulnerable ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2015-7843
- 2026-10-03 Alias added: GHSA-43mg-4cxq-6mjp
References
More Huawei Fusionserver Ch121 V3 vulnerabilities
- TI-2015-06515 The login page of the server on Huawei FusionServer rack servers RH2288 V3 with software… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2015-7843 · CVE Program
- CVE-2015-7843 · NVD
- FIRST EPSS
- GHSA-43mg-4cxq-6mjp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences