How severe is CVE-2014-9690?

CVE-2014-9690 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2014-9690 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (52nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2014-9690?

CVE-2014-9690 affects Huawei Ws318 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2014-9690?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2014-9690 published?

CVE-2014-9690 was published on 2017-04-02 and last updated on 2026-06-17.

CVE-2014-9690

CVE-2014-9690 is a high-severity vulnerability in Huawei Ws318 Firmware with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-332.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 1% (52nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-332
Affected product: Huawei Ws318 Firmware
Published: 2017-04-02
Last modified: 2026-06-17

Description

Huawei home gateways WS318 with software V100R001C01B022 and earlier versions are affected by the PIN offline brute force cracking vulnerability of the WPS protocol because the random number generator (RNG) used in the supplier's solution is not random enough. As a result, brute force cracking the PIN code is easier. After an attacker cracks the PIN, the attacker can access the Internet via the cracked device.

Frequently asked questions

What is CVE-2014-9690?: Huawei home gateways WS318 with software V100R001C01B022 and earlier versions are affected by the PIN offline brute force cracking vulnerability of the WPS protocol because the random number generator (RNG) used in the supplier's solution is not random enough. As a result, brute force cracking the PIN code is easier. After an attacker cracks the PIN, the attacker can access the Internet via the cracked device.
How severe is CVE-2014-9690?: CVE-2014-9690 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2014-9690 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (52nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2014-9690?: CVE-2014-9690 affects Huawei Ws318 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2014-9690?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2014-9690 published?: CVE-2014-9690 was published on 2017-04-02 and last updated on 2026-06-17.

References

http://www.huawei.com/en/psirt/security-advisories/hw-408091

Affected products (1)

cpe:2.3:o:huawei:ws318_firmware:*:*:*:*:*:*:*:*

Other CWE-332 vulnerabilities

CVE-2018-9057 — Critical (CVSS 9.8): aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through…
CVE-2016-10743 — High (CVSS 7.5): hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.
CVE-2016-9154 — High (CVSS 7.5): Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D,…
CVE-2026-3290 — High (CVSS 7.4): Timing limitations of the HRNG in RS9116 when power save mode is enabled results in predictable values
CVE-2017-18486 — High (CVSS 7.2): Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the…
CVE-2019-1715 — Medium (CVSS 5.3): A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG),…

Browse all CWE-332 vulnerabilities →