Authentication bypass in Huawei products - CVE-2014-9222

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass authentication mechanisms.

The vulnerability exists due to a design error when handling cookies. A remote unauthenticated attacker can send specially crafted cookie, bypass authentication mechanisms and gain complete control over the affected device. This exploitation technique is known as "Misfortune Cookie".

Successful exploitation of this vulnerability may allow a remote attacker to gain complete control over the vulnerable device.

How to mitigate CVE-2014-9222

Sources

• https://www.allegrosoft.com/allegro-software-urges-manufacturers-to-maintain-firmware-for-highest-le...
• http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-407666.htm