Improper authentication in Huawei 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3…
Priority MEDIUM 40CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specially crafted login messages to the affected products. Due to improper authentication design, successful exploit enables low privileged users to get or modify passwords of highly privileged users.
Why it matters now
EPSS 0.00816 57th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Huawei | 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5 ; CH121 V5 ; CH140 V3; CH140L V3; CH220 V3; CH222 V3; CH242 V3; CH242 V5 ; RH1288 V3; RH2288 V3; RH2288H V3; XH310 V3; XH321 V3; XH321 V5; XH620 V3 | 1288H V5 V100R005C00; 2288H V5 V100R005C00; 2488 V5 V100R005C00; CH121 V3 V100R001C00; CH121L V3 V100R001C00; CH121L V5 V100R001C00; CH121 V5 V100R001C00; CH140 V3 V100R001C00; CH140L V3 V100R001C00; CH220 V3 V100R001C00; CH222 V3 V100R001C00; CH242 V3 V100R001C00; CH242 V5 V100R001C00; RH1288 V3 V100R003C00; RH2288 V3 V100R003C00; RH2288H V3 V100R003C00; XH310 V3 V100R003C00; XH321 V3 V100R003C00; XH321 V5 V100R005C00; XH620 V3 V100R003C00 | — | No fix listed | CNA |
- 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5 ; CH121 V5 ; CH140 V3; CH140L V3; CH220 V3; CH222 V3; CH242 V3; CH242 V5 ; RH1288 V3; RH2288 V3; RH2288H V3; XH310 V3; XH321 V3; XH321 V5; XH620 V3 VendorHuawei Affected 1288H V5 V100R005C00; 2288H V5 V100R005C00; 2488 V5 V100R005C00; CH121 V3 V100R001C00; CH121L V3 V100R001C00; CH121L V5 V100R001C00; CH121 V5 V100R001C00; CH140 V3 V100R001C00; CH140L V3 V100R001C00; CH220 V3 V100R001C00; CH222 V3 V100R001C00; CH242 V3 V100R001C00; CH242 V5 V100R001C00; RH1288 V3 V100R003C00; RH2288 V3 V100R003C00; RH2288H V3 V100R003C00; XH310 V3 V100R003C00; XH321 V3 V100R003C00; XH321 V5 V100R005C00; XH620 V3 V100R003C00 Fixed in — No fix listed CNA
CPE configurations NVD · 40
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:1288h_v5_firmware:100r005c00:*:*:*:*:*:*:* | 100r005c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:1288h_v5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:2288h_v5_firmware:100r005c00:*:*:*:*:*:*:* | 100r005c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:2288h_v5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:2488_v5_firmware:100r005c00:*:*:*:*:*:*:* | 100r005c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:2488_v5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:ch121_v3_firmware:100r001c00:*:*:*:*:*:*:* | 100r001c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:ch121_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:ch121l_v3_firmware:100r001c00:*:*:*:*:*:*:* | 100r001c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:ch121l_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:huawei:1288h_v5_firmware:100r005c00:*:*:*:*:*:*:* Versions 100r005c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:1288h_v5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:2288h_v5_firmware:100r005c00:*:*:*:*:*:*:* Versions 100r005c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:2288h_v5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:2488_v5_firmware:100r005c00:*:*:*:*:*:*:* Versions 100r005c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:2488_v5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:ch121_v3_firmware:100r001c00:*:*:*:*:*:*:* Versions 100r001c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:ch121_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:ch121l_v3_firmware:100r001c00:*:*:*:*:*:*:* Versions 100r001c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:ch121l_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Show 30 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:ch121l_v5_firmware:100r001c00:*:*:*:*:*:*:* | 100r001c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:ch121l_v5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:ch121_v5_firmware:100r001c00:*:*:*:*:*:*:* | 100r001c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:ch121_v5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:ch140_v3_firmware:100r001c00:*:*:*:*:*:*:* | 100r001c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:ch140_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:ch140l_v3_firmware:100r001c00:*:*:*:*:*:*:* | 100r001c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:ch140l_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:ch220_v3_firmware:100r001c00:*:*:*:*:*:*:* | 100r001c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:ch220_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:ch222_v3_firmware:100r001c00:*:*:*:*:*:*:* | 100r001c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:ch222_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:ch242_v3_firmware:100r001c00:*:*:*:*:*:*:* | 100r001c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:ch242_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:ch242_v5_firmware:100r001c00:*:*:*:*:*:*:* | 100r001c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:ch242_v5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:rh1288_v3_firmware:100r003c00:*:*:*:*:*:*:* | 100r003c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:rh1288_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:rh2288_v3_firmware:100r003c00:*:*:*:*:*:*:* | 100r003c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:rh2288_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:xh310_v3_firmware:100r003c00:*:*:*:*:*:*:* | 100r003c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:xh310_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:xh321_v3_firmware:100r003c00:*:*:*:*:*:*:* | 100r003c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:xh321_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:xh321_v5_firmware:100r005c00:*:*:*:*:*:*:* | 100r005c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:xh321_v5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:rh2288h_v3_firmware:100r003c00:*:*:*:*:*:*:* | 100r003c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:rh2288h_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:xh620_v3_firmware:100r003c00:*:*:*:*:*:*:* | 100r003c00 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:xh620_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:huawei:ch121l_v5_firmware:100r001c00:*:*:*:*:*:*:* Versions 100r001c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:ch121l_v5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:ch121_v5_firmware:100r001c00:*:*:*:*:*:*:* Versions 100r001c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:ch121_v5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:ch140_v3_firmware:100r001c00:*:*:*:*:*:*:* Versions 100r001c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:ch140_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:ch140l_v3_firmware:100r001c00:*:*:*:*:*:*:* Versions 100r001c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:ch140l_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:ch220_v3_firmware:100r001c00:*:*:*:*:*:*:* Versions 100r001c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:ch220_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:ch222_v3_firmware:100r001c00:*:*:*:*:*:*:* Versions 100r001c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:ch222_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:ch242_v3_firmware:100r001c00:*:*:*:*:*:*:* Versions 100r001c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:ch242_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:ch242_v5_firmware:100r001c00:*:*:*:*:*:*:* Versions 100r001c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:ch242_v5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:rh1288_v3_firmware:100r003c00:*:*:*:*:*:*:* Versions 100r003c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:rh1288_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:rh2288_v3_firmware:100r003c00:*:*:*:*:*:*:* Versions 100r003c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:rh2288_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:xh310_v3_firmware:100r003c00:*:*:*:*:*:*:* Versions 100r003c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:xh310_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:xh321_v3_firmware:100r003c00:*:*:*:*:*:*:* Versions 100r003c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:xh321_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:xh321_v5_firmware:100r005c00:*:*:*:*:*:*:* Versions 100r005c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:xh321_v5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:rh2288h_v3_firmware:100r003c00:*:*:*:*:*:*:* Versions 100r003c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:rh2288h_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:xh620_v3_firmware:100r003c00:*:*:*:*:*:*:* Versions 100r003c00 Vulnerable ·Huawei
- cpe:2.3:h:huawei:xh620_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-7949
- 2026-10-03 Alias added: GHSA-x2jh-mxrp-cv8g
References
More Huawei 1288h V5 Firmware vulnerabilities
- TI-2018-05755 Code injection in Huawei 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5… CVSS 3.0HIGH 8.8
- TI-2018-05754 Code injection in Huawei 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3; CH121L V5… CVSS 3.0HIGH 8.8
- TI-2018-05749 Improper authentication in Huawei 1288H V5; 2288H V5; 2488 V5 ; CH121 V3; CH121L V3… CVSS 3.0HIGH 8.8
- TI-2018-05722 Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection… CVSS 3.0HIGH 8.8
- TI-2018-05721 Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection… CVSS 3.0HIGH 8.8
- TI-2018-05720 Huawei 1288H V5 and 288H V5 with software of V100R005C00 have a JSON injection… CVSS 3.0HIGH 8.8
Sources
- CVE-2018-7949 · CVE Program
- CVE-2018-7949 · NVD
- FIRST EPSS
- GHSA-x2jh-mxrp-cv8g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences