CVE-2016-6670

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-09-07 · updated 2026-06-17
Weakness: CWE-200

Description

Huawei S7700, S9300, S9700, and S12700 devices with software before V200R008C00SPC500 use random numbers with insufficient entropy to generate self-signed certificates, which makes it easier for remote attackers to discover private keys by leveraging knowledge of a certificate.

Affected products

Huawei S7700 Firmware: v200r003c00, v200r005c00
Huawei S9300 Firmware: v200r003c00, v200r005c00
Huawei S9700 Firmware: v200r003c00, v200r005c00
Huawei Firmware S12700: v200r005c00

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160810-01-certificate-en
http://www.securityfocus.com/bid/92438
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160810-01-certificate-en
http://www.securityfocus.com/bid/92438

Get alerted when CVE-2016-6670 or the next vulnerability affects your stack