Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2016-7107: Huawei UMA lets remote attackers reset user passwords
CVE-2016-7107 · published 10 years ago
Summary
The Huawei Unified Maintenance Audit tool can be tricked into changing any user's password, which could let an outsider alter or delete important data. This risk exists in versions before V200R001C00SPC200 SPH206. Update the software to the latest version or apply the vendor's recommended patch to stop the password reset issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| huawei | uma |
<= v200r001c00spc200 cpe:2.3:a:huawei:uma:*:*:*:*:*:*:*:* |
Original advisory text
Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequently affect system data integrity via unspecified vectors.
Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequently affect system data integrity via unspecified vectors.
References
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160824-02-uma-en Vendor Advisory
- http://www.securityfocus.com/bid/92619 Third Party Advisory VDB Entry
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-284Improper Access Control
Timeline
Published7 Sep 2016
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-7107 · NVD
Track software like this
Free during beta