CVE-2009-2272: The Huawei D100 stores the administrator's account name and password in cleartext in a cookie, which allows...

Security readout for executives and security teams

Huawei D100 reportedly kept the administrator username and password in a browser cookie without encryption. Anyone able to read that cookie or observe unencrypted HTTP traffic could learn the admin credentials and potentially manage the device. The sources do not name a patch, affected firmware versions, or active exploitation. Exposure is likely limited to Huawei D100 devices using the vulnerable web administration behavior, especially where management occurs over HTTP or on shared or untrusted networks. The source bundle does not identify exact firmware versions, deployment prevalence, or whether other Huawei devices are affected. Treat this as a targeted legacy-device exposure issue. Prioritize environments where Huawei D100 administration occurs on untrusted networks or where local workstation access is weak. Urgency increases if the device is still operational and no vendor-supported remediation exists. Mitigation focus: Check Huawei or device-owner guidance for firmware updates or replacement advice.; Restrict administrative access to trusted networks only.; Avoid administering the device over shared or untrusted networks..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.