Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2014-5394: Huawei Campus switches expose usernames over SSH
CVE-2014-5394 · published 8 years ago
Summary
Several Huawei Campus switch models let a remote user discover the login names used on the device by sending specially crafted SSH requests. Knowing valid usernames makes it easier for attackers to guess passwords and gain access. Apply the latest firmware updates from Huawei as soon as possible to stop the enumeration.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| huawei | s9300_firmware |
v200r001c00spc300 v200r002c00spc300 v200r003c00spc500 cpe:2.3:o:huawei:s9300_firmware:v200r001c00spc300:*:*:*:*:*:*:* |
| huawei | s9300e_firmware |
v200r001c00spc300 v200r002c00spc300 v200r003c00spc500 cpe:2.3:o:huawei:s9300e_firmware:v200r001c00spc300:*:*:*:*:*:*:* |
| huawei | s7700_firmware |
v200r001c00spc300 v200r002c00spc300 v200r003c00spc500 cpe:2.3:o:huawei:s7700_firmware:v200r001c00spc300:*:*:*:*:*:*:* |
| huawei | s9700_firmware |
v200r001c00spc300 v200r002c00spc300 v200r003c00spc500 cpe:2.3:o:huawei:s9700_firmware:v200r001c00spc300:*:*:*:*:*:*:* |
| huawei | s5700_firmware |
v200r001c00spc300 v200r002c00spc300 v200r003c00spc300 cpe:2.3:o:huawei:s5700_firmware:v200r001c00spc300:*:*:*:*:*:*:* |
| huawei | s6700_firmware |
v200r001c00spc300 v200r002c00spc300 v200r003c00spc300 cpe:2.3:o:huawei:s6700_firmware:v200r001c00spc300:*:*:*:*:*:*:* |
| huawei | s5300_firmware |
v200r001c00spc300 v200r002c00spc300 v200r003c00spc300 cpe:2.3:o:huawei:s5300_firmware:v200r001c00spc300:*:*:*:*:*:*:* |
| huawei | s6300_firmware |
v200r001c00spc300 v200r002c00spc300 v200r003c00spc300 cpe:2.3:o:huawei:s6300_firmware:v200r001c00spc300:*:*:*:*:*:*:* |
| huawei | s2300_firmware |
v100r006c05 cpe:2.3:o:huawei:s2300_firmware:v100r006c05:*:*:*:*:*:*:* |
| huawei | s2700_firmware |
v100r006c05 cpe:2.3:o:huawei:s2700_firmware:v100r006c05:*:*:*:*:*:*:* |
| huawei | s3300_firmware |
v100r006c05 cpe:2.3:o:huawei:s3300_firmware:v100r006c05:*:*:*:*:*:*:* |
| huawei | s3700_firmware |
v100r006c05 cpe:2.3:o:huawei:s3700_firmware:v100r006c05:*:*:*:*:*:*:* |
Original advisory text
Multiple Huawei Campus switches allow remote attackers to enumerate usernames via vectors involving use of SSH by the maintenance terminal.
Multiple Huawei Campus switches allow remote attackers to enumerate usernames via vectors involving use of SSH by the maintenance terminal.
References
- http://www.huawei.com/us/psirt/security-advisories/2014/hw-362701 Vendor Advisory
- http://www.securityfocus.com/bid/69302 Third Party Advisory VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/97763 Third Party Advisory VDB Entry
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-200Information Exposure
Timeline
Published8 Jan 2018
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2014-5394 · NVD
Track software like this
Free during beta