CVE-2014-2946

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-06-02 · updated 2026-06-17
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in api/sms/send-sms in the Web UI 11.010.06.01.858 on Huawei E303 modems with software 22.157.18.00.858 allows remote attackers to hijack the authentication of administrators for requests that perform API operations and send SMS messages via a request element in an XML document.

Affected products

Huawei E303 Modem: ch2e303sm
Huawei E303 Modem Firmware: 22.157.18.00.858
Huawei Webui: 11.010.06.01.858

References

http://b.fl7.de/2014/05/huawei-e303-sms-vulnerability-CVE-2014-2946.html
http://secunia.com/advisories/58992
http://www.kb.cert.org/vuls/id/325636
http://b.fl7.de/2014/05/huawei-e303-sms-vulnerability-CVE-2014-2946.html
http://secunia.com/advisories/58992
http://www.kb.cert.org/vuls/id/325636

Get alerted when CVE-2014-2946 or the next vulnerability affects your stack