Security Advisory - Two Command Injection Vulnerabilities in Huawei UMA

The Unified Maintenance Audit (UMA) system provides a unified portal for O&M operations, controls and records users’ O&M operations, and supports auditing by way of command display and video replay.

The UMA has two command injection vulnerabilities due to the lack of validation on special fields. An attacker can insert special characters to modify the fields to launch a command injection attack. Successful exploit could allow the attacker to obtain sensitive information of the device and modify device data, causing the unavailability of the device. (Vulnerability ID: HWPSIRT-2016-07047) and (Vulnerability ID: HWPSIRT-2016-07048)

This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2016-7109 and CVE-2016-7110.

Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160824-01-uma-en