Some Huawei home routers have a connection hijacking vulnerability.
Priority MEDIUM 41CWE-420Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Some Huawei home routers have a connection hijacking vulnerability. Successful exploitation of this vulnerability may cause DoS or information leakage.(Vulnerability ID:HWPSIRT-2023-76605) This vulnerability has been assigned a (CVE)ID:CVE-2023-7266
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00282 20th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Huawei | TC7001-10 | 2.0.0.336(SP6C300) | — | No fix listed | CNA |
| Huawei | WS7200-10 | WS7200-10-OTA 3.0.3.215-fullpackage(auto_1) | — | No fix listed | CNA |
| Huawei | WS7206-10 | WS7206-10-OTA 4.0.0.16(V3R2)-fullpackage(auto) | — | No fix listed | CNA |
- TC7001-10 VendorHuawei Affected 2.0.0.336(SP6C300) Fixed in — No fix listed CNA
- WS7200-10 VendorHuawei Affected WS7200-10-OTA 3.0.3.215-fullpackage(auto_1) Fixed in — No fix listed CNA
- WS7206-10 VendorHuawei Affected WS7206-10-OTA 4.0.0.16(V3R2)-fullpackage(auto) Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:tc7001-10_firmware:2.0.0.336\(sp6c300\):*:*:*:*:*:*:* | 2.0.0.336(sp6c300) | Vulnerable | Huawei |
| cpe:2.3:h:huawei:tc7001-10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:ws7200-10_firmware:3.0.3.215:*:*:*:*:*:*:* | 3.0.3.215 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:ws7200-10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:ws7206-10_firmware:4.0.0.16\(v3r2\):*:*:*:*:*:*:* | 4.0.0.16(v3r2) | Vulnerable | Huawei |
| cpe:2.3:h:huawei:ws7206-10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:huawei:tc7001-10_firmware:2.0.0.336\(sp6c300\):*:*:*:*:*:*:* Versions 2.0.0.336(sp6c300) Vulnerable ·Huawei
- cpe:2.3:h:huawei:tc7001-10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:ws7200-10_firmware:3.0.3.215:*:*:*:*:*:*:* Versions 3.0.3.215 Vulnerable ·Huawei
- cpe:2.3:h:huawei:ws7200-10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:ws7206-10_firmware:4.0.0.16\(v3r2\):*:*:*:*:*:*:* Versions 4.0.0.16(v3r2) Vulnerable ·Huawei
- cpe:2.3:h:huawei:ws7206-10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-7266
- 2026-10-03 Alias added: GHSA-33fg-f8wx-chw2
References
Sources
- CVE-2023-7266 · CVE Program
- CVE-2023-7266 · NVD
- FIRST EPSS
- GHSA-33fg-f8wx-chw2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences