Critical severity9.8NVD Advisory· Published Nov 22, 2017· Updated May 13, 2026

CVE-2017-2738

Description

VCM5010 with software versions earlier before V100R002C50SPC100 has an authentication bypass vulnerability. This is due to improper implementation of authentication for accessing web pages. An unauthenticated attacker could bypass the authentication by sending a crafted HTTP request. 5010 with software versions earlier before V100R002C50SPC100 has an arbitrary file upload vulnerability. The software does not validate the files that uploaded. An authenticated attacker could upload arbitrary files to the system.

Affected products

Huawei/Vcm5010 Firmware
cpe:2.3:o:huawei:vcm5010_firmware:*:*:*:*:*:*:*:*
Range: <v100r002c50spc100
Huawei Technologies Co., Ltd./VCM5010v5
Range: Versions earlier before V100R002C50SPC100

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20170329-01-vcm-ennvdVendor Advisory
www.securityfocus.com/bid/97231nvdThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000