How severe is CVE-2015-7842?

CVE-2015-7842 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability high.

Is CVE-2015-7842 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (50th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-7842?

CVE-2015-7842 primarily affects Huawei Rh2288 V3 Firmware. In total, 10 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-7842?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2015-7842 published?

CVE-2015-7842 was published on 2017-10-10 and last updated on 2026-06-17.

CVE-2015-7842

CVE-2015-7842 is a high-severity vulnerability in Huawei Rh2288 V3 Firmware with a CVSS 3.x base score of 7.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-275.

Key facts

Severity: High (CVSS 3.x base score 7.1)
CVSS v2: 5.5
EPSS exploit prediction: 1% (50th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-275
Affected product: Huawei Rh2288 V3 Firmware
Published: 2017-10-10
Last modified: 2026-06-17

Description

Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allow remote authenticated operators to change server information by leveraging failure to verify user permissions.

Frequently asked questions

What is CVE-2015-7842?: Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allow remote authenticated operators to change server information by leveraging failure to verify user permissions.
How severe is CVE-2015-7842?: CVE-2015-7842 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability high.
Is CVE-2015-7842 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (50th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2015-7842?: CVE-2015-7842 primarily affects Huawei Rh2288 V3 Firmware. In total, 10 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2015-7842?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2015-7842 published?: CVE-2015-7842 was published on 2017-10-10 and last updated on 2026-06-17.

References

Affected products (10)

cpe:2.3:o:huawei:rh2288_v3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:rh2288h_v3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:xh628_v3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:rh1288_v3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:rh2288a_v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:rh1288a_v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:rh8100_v3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:ch222_v3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:ch220_v3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:huawei:ch121_v3_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Huawei Rh2288 V3 Firmware

CVE-2018-7943 — High (CVSS 8.8): There is an authentication bypass vulnerability in some Huawei servers. A remote attacker with low privilege may bypass…
CVE-2018-7951 — High (CVSS 8.8): The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due…
CVE-2018-7950 — High (CVSS 8.8): The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due…
CVE-2018-7949 — High (CVSS 8.8): The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation…
CVE-2018-7941 — High (CVSS 8.8): Huawei iBMC V200R002C60 have an authentication bypass vulnerability. A remote attacker with low privilege may craft…

All CVEs affecting Huawei Rh2288 V3 Firmware →

Other CWE-275 vulnerabilities

CVE-2017-6513 — Critical (CVSS 9.9): The WHMCS Reseller Module V2 2.0.2 in Softaculous Virtualizor before 2.9.1.0 does not verify the user correctly, which…
CVE-2017-17060 — Critical (CVSS 9.8): OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: Insecure Permissions.
CVE-2017-16887 — Critical (CVSS 9.8): The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38 uses SOAP based web services in order to…
CVE-2023-39399 — Critical (CVSS 9.1): Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause…
CVE-2023-39398 — Critical (CVSS 9.1): Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause…
CVE-2019-2177 — High (CVSS 8.8): In isPreferred of HidProfile.java in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible device type confusion…

Browse all CWE-275 vulnerabilities →