CVE-2016-8789
MEDIUMHuawei eSpace IAD V300R001C03, V300R001C04, V300R001C06, V300R001C20, V300R001C07 - Cross-Site Scripting
Title source: llmDescription
Huawei eSpace Integrated Access Device (IAD) with software V300R001C03, V300R001C04, V300R001C06, V300R001C20, and V300R001C07 allows an attacker to trick a user into clicking a URL containing malicious scripts to obtain user information or hijack the session, aka XSS.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161130-01-espace-en
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/94613
Scores
CVSS v3
6.1
EPSS
0.0011
EPSS Percentile
28.7%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (6)
huawei/espace_integrated_access_device_firmware
v300r001c03
huawei/espace_integrated_access_device_firmware
v300r001c04
huawei/espace_integrated_access_device_firmware
v300r001c06
huawei/espace_integrated_access_device_firmware
v300r001c07
huawei/espace_integrated_access_device_firmware
v300r001c20
n/a/eSpace IAD V300R001C03, V300R001C04, V300R001C06, V300R001C20 and V300R001C07
eSpace IAD V300R001C03, V300R001C04, V300R001C06, V300R001C20 and V300R001C07
Published
Apr 02, 2017
Tracked Since
Feb 18, 2026