CVE-2017-17167

Vulnerability

Huawei DP300 V500R002C00, TP3206 V100R002C00, and ViewPoint 9030 V100R011C02 and V100R011C03 use a broken or risky cryptographic algorithm in SSL [1]. The software employs a weak cipher that can be broken using well-known techniques, compromising the security of encrypted communications.

Exploitation

A remote unauthenticated attacker can exploit this vulnerability by intercepting SSL/TLS traffic between the affected device and its peers [1]. Using standard cryptanalytic methods, the attacker can break the weak algorithm without requiring any prior authentication or user interaction.

Impact

Successful exploitation results in the exposure of sensitive information transmitted over SSL [1]. The attacker gains access to confidential data, leading to a breach of confidentiality. No other impacts such as code execution or privilege escalation are described.

Mitigation

Huawei has released software updates to fix this vulnerability [1]. The resolved versions are: DP300 V500R002C00SPCb00, TP3206 V100R002C00SPC800, and ViewPoint 9030 should be upgraded to V100R011C03SPC800. Users should apply these updates as soon as possible.