XSS in Huawei E355

CVE-2014-2968

Cross-site scripting (XSS) vulnerability in the web interface on the Huawei E355 CH1E355SM modem with software 21.157.37.01.910 and Web UI 11.001.08.00.03 allows remote attackers to inject arbitrary web script or HTML via an SMS message.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.008 (52.8th percentile) — read the EPSS interpretation.

Affected products

Huawei E355 — versions ch1e355sm
Huawei E355_firmware — versions 21.157.37.01.910
Huawei E355_web_ui — versions 11.001.08.00.03
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cret@cert.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)