CVE-2014-8331: Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3236 before E3276sTCPU-V200R00...

Security readout for executives and security teams

This issue affects Huawei HiLink mobile broadband devices where the management interface did not sufficiently protect administrator actions from cross-site request forgery. If an admin is logged in and is tricked into visiting malicious content, settings or device functions could be changed without deliberate approval. Most likely exposure is legacy Huawei HiLink E3236 or E3276 devices still running pre-fixed TCPU/WebUI builds. Internet exposure is not proven by the sources; local or admin-network reachability of the device management interface would matter. Treat as a moderate legacy-device risk. Prioritize if these Huawei modems manage business connectivity, are administered from shared workstations, or remain unsupported. No KEV evidence of active exploitation is provided, so urgency is lower than internet-exploited critical flaws but patching or retirement should not be deferred indefinitely. Mitigation focus: Inventory Huawei HiLink E3236 and E3276 devices and record TCPU/WebUI versions.; Update firmware/WebUI following Huawei PSIRT guidance for the listed fixed or later builds.; Restrict management interface access to trusted administrator networks..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.