1791
CVEs
148
Critical
763
High
2
KEV
33
PoC
879
Unpatched C/H
2.7%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
148
HIGH
763
MEDIUM
794
LOW
85
Monthly CVE Trend
Affected Products (30)
Harmonyos
815
Emui
549
Magic Ui
180
Secospace Usg6600 Firmware
43
Usg9500 Firmware
42
P30 Firmware
38
S5700 Firmware
28
Nip6800 Firmware
27
Mate 20 Firmware
27
P30 Pro Firmware
25
S7700 Firmware
23
P8 Firmware
22
Secospace Usg6300 Firmware
22
S6700 Firmware
21
Fusionsphere Openstack
21
Secospace Usg6500 Firmware
21
Cloudengine 12800 Firmware
21
Fusioncompute
19
S9700 Firmware
19
S9300 Firmware
18
Mate S Firmware
18
P9 Firmware
18
Uma
18
Ar3200 Firmware
17
S12700 Firmware
17
Mate 30 Firmware
16
Cloudengine 6800 Firmware
16
Nip6600 Firmware
16
P10 Plus Firmware
15
Cloudengine 7800 Firmware
15
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2014-9222 | AllegroSoft RomPager 4.34 and earlier, as used in Huawei Home Gateway products and other vendors and products, allows remote attackers to gain privileges via a crafted cookie that triggers memory. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.4%. | CRITICAL | 10.0 | 86.4% | 156 |
PoC
No patch
|
| CVE-2017-14491 | Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 57.8%. | CRITICAL | 9.8 | 57.8% | 127 |
PoC
|
| CVE-2013-4630 | Stack-based buffer overflow on Huawei AR 150, 200, 1200, 2200, and 3200 routers, when SNMPv3 debugging is enabled, allows remote attackers to execute arbitrary code via malformed SNMPv3 requests. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 19.5%. | HIGH | 7.6 | 19.5% | 78 |
PoC
No patch
|
| CVE-2019-2215 | A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available. | HIGH | 7.8 | 72.1% | 74 |
KEV
PoC
|
| CVE-2017-3216 | WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 3.2% | 72 |
PoC
No patch
|
| CVE-2016-2231 | The Windows-based Host Interface Program (WHIP) service on Huawei SmartAX MT882 devices V200R002B022 Arg relies on the client to send a length field that is consistent with a buffer size, which. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 0.3% | 69 |
PoC
No patch
|
| CVE-2012-4960 | The Huawei NE5000E, MA5200G, NE40E, NE80E, ATN, NE40, NE80, NE20E-X6, NE20, ME60, CX600, CX200, CX300, ACU, WLAN AC 6605, S9300, S7700, S2300, S3300, S5300, S3300HI, S5300HI, S5306, S6300, S2700,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 12.3%. | MEDIUM | 6.5 | 12.3% | 65 |
PoC
No patch
|
| CVE-2015-7254 | Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 19.2%. | MEDIUM | 5.0 | 19.2% | 64 |
PoC
No patch
|
| CVE-2020-0022 | In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available. | HIGH | 8.8 | 5.4% | 64 |
PoC
|
| CVE-2020-37220 | Huawei HG630 V2 router contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain administrative access by retrieving the device serial number. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.7 | 0.1% | 64 |
PoC
No patch
|
| CVE-2013-4631 | Huawei AR 150, 200, 1200, 2200, and 3200 routers, when SNMPv3 is enabled, allow remote attackers to cause a denial of service (device crash) via malformed SNMPv3 requests that leverage unspecified. Rated high severity (CVSS 7.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 4.2% | 63 |
PoC
No patch
|
| CVE-2015-8088 | Heap-based buffer overflow in the HIFI driver in Huawei Mate 7 phones with software MT7-UL00 before MT7-UL00C17B354, MT7-TL10 before MT7-TL10C00B354, MT7-TL00 before MT7-TL00C01B354, and MT7-CL00. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.8% | 60 |
PoC
No patch
|
| CVE-2014-8358 | Huawei EC156, EC176, and EC177 USB Modem products with software before UTPS-V200R003B015D02SP07C1014 (23.015.02.07.1014) and before V200R003B015D02SP08C1014 (23.015.02.08.1014) use a weak ACL for the. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.8% | 60 |
PoC
No patch
|
| CVE-2016-5821 | Huawei HiSuite before 4.0.4.204_ove (Out of China) and before 4.0.4.301 (China) use a weak ACL (FILE_WRITE_DATA for BUILTIN\Users) for the HiSuite service directory, which allows local users to gain. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.1% | 59 |
PoC
No patch
|
| CVE-2019-14835 | A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available. | HIGH | 7.8 | 0.6% | 59 |
PoC
|