CVE-2018-7951
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON...
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to obtain the management privilege of the system.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to obtain the management privilege of the system.
- Record
CVE-2018-7951- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to obtain the management privilege of the system.
- Record
CVE-2018-7951- Updated
- 2026-11-02
EUVDEUVD-2018-19663 No score
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to obtain the management privilege of the system.
- Record
EUVD-2018-19663- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c445-2cgq-9843
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON...
The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to obtain the management privilege of the system.
- Record
GHSA-c445-2cgq-9843- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
- huawei 1288h v5 firmware
- huawei 2288h v5 firmware
- huawei 2488 v5 firmware
- huawei ch121 v3 firmware
- huawei ch121 v5 firmware
- huawei ch121l v3 firmware
- huawei ch121l v5 firmware
- huawei ch140 v3 firmware
- huawei ch140l v3 firmware
- huawei ch220 v3 firmware
- huawei ch222 v3 firmware
- huawei ch242 v3 firmware
Show 9 moreShow less
- huawei ch242 v5 firmware
- huawei rh1288 v3 firmware
- huawei rh2288 v3 firmware
- huawei rh2288h v3 firmware
- huawei xh310 v3 firmware
- huawei xh321 v3 firmware
- huawei xh321 v5 firmware
- huawei xh620 v3 firmware
- huawei technologies co., ltd. 1288h v5; 2288h v5; 2488 v5 ; ch121 v3; ch121l v3; ch121l v5 ; ch121 v5 ; ch140 v3; ch140l v3; ch220 v3; ch222 v3; ch242 v3; ch242 v5 ; rh1288 v3; rh2288 v3; rh2288h v3; xh310 v3; xh321 v3; xh321 v5; xh620 v3
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-7951 is a high vulnerability (CVSS 8.8) in Huawei 1288h V5 Firmware, published June 1, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.46%, the 73rd percentile. No source names a fixed version.