CVE-2018-7949
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege...
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specially crafted login messages to the affected products. Due to improper authentication design, successful exploit enables low privileged users to get or modify passwords of highly privileged users.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specially crafted login messages to the affected products. Due to improper authentication design, successful exploit enables low privileged users to get or modify passwords of highly privileged users.
- Record
CVE-2018-7949- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specially crafted login messages to the affected products. Due to improper authentication design, successful exploit enables low privileged users to get or modify passwords of highly privileged users.
- Record
CVE-2018-7949- Updated
- 2026-11-02
EUVDEUVD-2018-19661 No score
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specially crafted login messages to the affected products. Due to improper authentication design, successful exploit enables low privileged users to get or modify passwords of highly privileged users.
- Record
EUVD-2018-19661- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x2jh-mxrp-cv8g
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege...
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specially crafted login messages to the affected products. Due to improper authentication design, successful exploit enables low privileged users to get or modify passwords of highly privileged users.
- Record
GHSA-x2jh-mxrp-cv8g- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
- huawei 1288h v5 firmware
- huawei 2288h v5 firmware
- huawei 2488 v5 firmware
- huawei ch121 v3 firmware
- huawei ch121 v5 firmware
- huawei ch121l v3 firmware
- huawei ch121l v5 firmware
- huawei ch140 v3 firmware
- huawei ch140l v3 firmware
- huawei ch220 v3 firmware
- huawei ch222 v3 firmware
- huawei ch242 v3 firmware
Show 9 moreShow less
- huawei ch242 v5 firmware
- huawei rh1288 v3 firmware
- huawei rh2288 v3 firmware
- huawei rh2288h v3 firmware
- huawei xh310 v3 firmware
- huawei xh321 v3 firmware
- huawei xh321 v5 firmware
- huawei xh620 v3 firmware
- huawei technologies co., ltd. 1288h v5; 2288h v5; 2488 v5 ; ch121 v3; ch121l v3; ch121l v5 ; ch121 v5 ; ch140 v3; ch140l v3; ch220 v3; ch222 v3; ch242 v3; ch242 v5 ; rh1288 v3; rh2288 v3; rh2288h v3; xh310 v3; xh321 v3; xh321 v5; xh620 v3
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-7949 is a high vulnerability (CVSS 8.8) in Huawei 1288h V5 Firmware, published June 1, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. No source names a fixed version.