Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection…
Priority MEDIUM 40Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection vulnerability. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Due to insufficient verification of the input, this could be exploited to obtain the management privilege of the system.
Why it matters now
EPSS 0.01085 65th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Huawei | 1288H V5; 2288H V5 | V100R005C00 | — | No fix listed | CNA |
- 1288H V5; 2288H V5 VendorHuawei Affected V100R005C00 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:1288h_v5_firmware:v100r005c00:*:*:*:*:*:*:* | v100r005c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:1288h_v5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:2288h_v5_firmware:v100r005c00:*:*:*:*:*:*:* | v100r005c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:2288h_v5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:huawei:1288h_v5_firmware:v100r005c00:*:*:*:*:*:*:* Versions v100r005c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:1288h_v5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:2288h_v5_firmware:v100r005c00:*:*:*:*:*:*:* Versions v100r005c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:2288h_v5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-7904
- 2026-10-03 Alias added: GHSA-49p2-r329-r7xg
References
More Huawei 1288h V5 Firmware vulnerabilities
- TI-2018-05755 Code injection in Huawei 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5… CVSS 3.0HIGH 8.8
- TI-2018-05754 Code injection in Huawei 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5… CVSS 3.0HIGH 8.8
- TI-2018-05749 Improper authentication in Huawei 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3… CVSS 3.0HIGH 8.8
- TI-2018-05753 Improper authentication in Huawei 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3… CVSS 3.0HIGH 8.8
- TI-2018-05721 Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection… CVSS 3.0HIGH 8.8
- TI-2018-05720 Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection… CVSS 3.0HIGH 8.8
Sources
- CVE-2018-7904 · CVE Program
- CVE-2018-7904 · NVD
- FIRST EPSS
- GHSA-49p2-r329-r7xg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences