What is the CVSS score of CVE-2012-6571?

CVE-2012-6571 has a CVSS 2.0 base score of 7.5 (High). CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 0.2%.

Ar 18 1X CVE-2012-6571

HIGH

Cryptographic Issues (CWE-310)

2013-06-20 cve@mitre.org

Huawei Information Disclosure Ar 18 1X Ar 18 2X Ar 18 3X Ar 19 29 49 Ar 28 46 S2000 S2300 S2700 S3000 S3300 S3300Hi S3500 S3700 S3900 S5100 S5600 S7800 S8500

7.5

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:P/A:P

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Jun 20, 2013 - 15:55 cve.org

HIGH 7.5

DescriptionCVE.org

The HTTP module in the (1) Branch Intelligent Management System (BIMS) and (2) web management components on Huawei AR routers and S2000, S3000, S3500, S3900, S5100, S5600, and S7800 switches uses predictable Session ID values, which makes it easier for remote attackers to hijack sessions via a brute-force attack.

AnalysisAI

The HTTP module in the (1) Branch Intelligent Management System (BIMS) and (2) web management components on Huawei AR routers and S2000, S3000, S3500, S3900, S5100, S5600, and S7800 switches uses. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-310. The HTTP module in the (1) Branch Intelligent Management System (BIMS) and (2) web management components on Huawei AR routers and S2000, S3000, S3500, S3900, S5100, S5600, and S7800 switches uses predictable Session ID values, which makes it easier for remote attackers to hijack sessions via a brute-force attack. Affected products include: Huawei Ar 18-1X, Huawei Ar 18-2X, Huawei Ar 18-3X, Huawei Ar 19\/29\/49, Huawei Ar 28\/46.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.