CVE-2015-8085

CVE-2015-8085 is a medium-severity vulnerability in Huawei S9300 Firmware with a CVSS 3.x base score of 4.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-326.

Key facts

• Severity: Medium (CVSS 3.x base score 4.9)
• CVSS v2: 4.0
• EPSS exploit prediction: 0% (39th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-326
• Affected product: Huawei S9300 Firmware
• Published: 2016-10-03
• Last modified: 2026-06-17

Description

Huawei AR routers with software before V200R007C00SPC100; Quidway S9300 routers with software before V200R009C00; S12700 routers with software before V200R008C00SPC500; S9300, Quidway S5300, and S5300 routers with software before V200R007C00; and S5700 routers with software before V200R007C00SPC500 make it easier for remote authenticated administrators to obtain and decrypt passwords by leveraging selection of a reversible encryption algorithm.

Frequently asked questions

What is CVE-2015-8085?

Huawei AR routers with software before V200R007C00SPC100; Quidway S9300 routers with software before V200R009C00; S12700 routers with software before V200R008C00SPC500; S9300, Quidway S5300, and S5300 routers with software before V200R007C00; and S5700 routers with software before V200R007C00SPC500 make it easier for remote authenticated administrators to obtain and decrypt passwords by leveraging selection of a reversible encryption algorithm.

How severe is CVE-2015-8085?

CVE-2015-8085 has a CVSS 3.x base score of 4.9, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2015-8085 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (39th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-8085?

CVE-2015-8085 primarily affects Huawei S9300 Firmware. In total, 22 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-8085?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2015-8085 published?

CVE-2015-8085 was published on 2016-10-03 and last updated on 2026-06-17.

References

• http://www.huawei.com/en/psirt/security-advisories/hw-455876
• http://www.securityfocus.com/bid/76897

Affected products (22)

• cpe:2.3:o:huawei:s9300_firmware:v200r005c00spc300:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:s9300_firmware:v200r006c00spc500:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:s12700_firmware:v200r005c00:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:s12700_firmware:v200r006c00:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:quidway_s9300_firmware:v200r001c00spc300:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:quidway_s9300_firmware:v200r002c00spc100:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:quidway_s9300_firmware:v200r003c00spc500:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:ar_firmware:v200r001:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:ar_firmware:v200r002:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:ar_firmware:v200r003:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:ar_firmware:v200r005c10:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:ar_firmware:v200r005c20:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:ar_firmware:v200r005c30:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:quidway_s5300_firmware:v200r001c00spc300:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:s5700_firmware:v200r001c00:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:s5700_firmware:v200r002c00:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:s5700_firmware:v200r003c00:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:s5700_firmware:v200r005c00:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:s5700_firmware:v200r006c00:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:s5300_firmware:v200r002c00:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:s5300_firmware:v200r005c00spc500:*:*:*:*:*:*:*
• cpe:2.3:o:huawei:s5300_firmware:v200r006c00spc500:*:*:*:*:*:*:*

More vulnerabilities in Huawei S9300 Firmware

• CVE-2019-5285 — High (CVSS 7.5): Some Huawei S series switches have a DoS vulnerability. An unauthenticated remote attacker can send crafted packets to…
• CVE-2014-4705 — High (CVSS 7.5): Multiple heap-based buffer overflows in the eSap software platform in Huawei Campus S9300, S7700, S9700, S5300, S5700,…
• CVE-2017-8147 — High (CVSS 7.5): AC6005 V200R006C10SPC200,AC6605 V200R006C10SPC200,AR1200 with software V200R005C10CP0582T, V200R005C10HP0581T,…
• CVE-2015-3913 — High (CVSS 7.5): The IP stack in multiple Huawei Campus series switch models allows remote attackers to cause a denial of service…
• CVE-2015-2800 — High (CVSS 7.5): The user authentication module in Huawei Campus switches S5700, S5300, S6300, and S6700 with software before…
• CVE-2016-8797 — High (CVSS 7.5): Huawei AR3200 with software V200R007C00, V200R005C32, V200R005C20; S12700 with software V200R008C00, V200R007C00; S5300…

All CVEs affecting Huawei S9300 Firmware →

Other CWE-326 (Inadequate Encryption Strength) vulnerabilities

• CVE-2026-44523 — Critical (CVSS 10.0): Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the…
• CVE-2020-6966 — Critical (CVSS 10.0): In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information…
• CVE-2014-9199 — Critical (CVSS 10.0): The Clorius Controls Java web client before 01.00.0009g allows remote attackers to discover credentials by sniffing the…
• CVE-2018-25272 — Critical (CVSS 9.8): ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and…
• CVE-2025-12478 — Critical (CVSS 9.8): Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
• CVE-2022-24116 — Critical (CVSS 9.8): Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II…

Browse all CWE-326 (Inadequate Encryption Strength) vulnerabilities →