CVE-2015-8676

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-04-14 · updated 2026-06-17
Weakness: CWE-119

Description

Memory leak in Huawei S5300EI, S5300SI, S5310HI, S6300EI/ S2350EI, and S5300LI Campus series switches with software V200R001C00 before V200R001SPH018, V200R002C00 before V200R003SPH011, and V200R003C00 before V200R003SPH011; S9300, S7700, and S9700 Campus series switches with software V200R001C00 before V200R001SPH023, V200R002C00 before V200R003SPH011, and V200R003C00 before V200R003SPH011; and S2300 and S3300 Campus series switches with software V100R006C05 before V100R006SPH022 allows remote attackers to cause a denial of service (memory consumption and reboot) via a large number of ICMPv6 packets.

Affected products

Huawei S2300 Firmware: from v100r006c05 before v100r006sph022 — fixed in v100r006sph022
Huawei S2350Ei Firmware: from v200r001c00 before v200r001sph018; from v200r002c00 before v200r003sph011 — fixed in v200r001sph018, v200r003sph011
Huawei Technologies Co., Ltd. S3300: from v100r006c05 before v100r006sph022 — fixed in v100r006sph022
Huawei S5300Ei Firmware: from v200r001c00 before v200r001sph018; from v200r002c00 before v200r003sph011 — fixed in v200r001sph018, v200r003sph011
Huawei S5300Li Firmware: from v200r001c00 before v200r001sph018; from v200r002c00 before v200r003sph011 — fixed in v200r001sph018, v200r003sph011
Huawei S5300Si Firmware: from v200r001c00 before v200r001sph018; from v200r002c00 before v200r003sph011 — fixed in v200r001sph018, v200r003sph011
Huawei S5310Hi Firmware: from v200r001c00 before v200r001sph018; from v200r002c00 before v200r003sph011 — fixed in v200r001sph018, v200r003sph011
Huawei S6300Ei Firmware: from v200r001c00 before v200r001sph018; from v200r002c00 before v200r003sph011 — fixed in v200r001sph018, v200r003sph011
Huawei S7700 Firmware: from v200r001c00 before v200r001sph023; from v200r002c00 before v200r003c00; v200r003c00 — fixed in v200r001sph023, v200r003c00
Huawei S9300 Firmware: from v200r001c00 before v200r001sph023; from v200r002c00 before v200r003c00; v200r003c00 — fixed in v200r001sph023, v200r003c00
Huawei S9700 Firmware: from v200r001c00 before v200r001sph023; from v200r002c00 before v200r003c00; v200r003c00 — fixed in v200r001sph023, v200r003c00

How to fix

Upgrade to a fixed version: Huawei S2300 Firmware v100r006sph022; Huawei S2350Ei Firmware v200r001sph018, v200r003sph011; Huawei Technologies Co., Ltd. S3300 v100r006sph022; Huawei S5300Ei Firmware v200r001sph018, v200r003sph011; Huawei S5300Li Firmware v200r001sph018, v200r003sph011; Huawei S5300Si Firmware v200r001sph018, v200r003sph011; Huawei S5310Hi Firmware v200r001sph018, v200r003sph011; Huawei S6300Ei Firmware v200r001sph018, v200r003sph011; Huawei S7700 Firmware v200r001sph023, v200r003c00; Huawei S9300 Firmware v200r001sph023, v200r003c00; Huawei S9700 Firmware v200r001sph023, v200r003c00. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2015-8676 or the next vulnerability affects your stack