Use of a broken or risky cryptographic algorithm in several Huawei Products
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2019-19397 |
| CWE-ID | CWE-327 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Huawei S12700 Hardware solutions / Routers for home users Huawei S5700 Hardware solutions / Routers for home users Huawei S1700 Hardware solutions / Routers & switches, VoIP, GSM, etc Huawei S2700 Hardware solutions / Routers & switches, VoIP, GSM, etc Huawei S6700 Hardware solutions / Routers & switches, VoIP, GSM, etc Huawei S7700 Hardware solutions / Routers & switches, VoIP, GSM, etc Huawei S9700 Hardware solutions / Routers & switches, VoIP, GSM, etc |
| Vendor | Huawei |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Use of a broken or risky cryptographic algorithm
EUVDB-ID: #VU23420
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-19397
CWE-ID:
CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information on the target system.
The vulnerability exists due to the affected products use weak algorithms by default. A remote attacker can exploit this vulnerability to cause information leaks.
MitigationInstall updates from vendor's website.
Vulnerable software versionsHuawei S12700: V200R007C00 - V200R012C00
Huawei S1700: V200R006C10 - V200R012C20
Huawei S2700: V200R006C00 - V200R012C00
Huawei S5700: V200R005C00 - V200R012C20
Huawei S6700: V200R005C00 - V200R012C00
Huawei S7700: V200R006C00 - V200R012C00
Huawei S9700: V200R006C00 - V200R012C00
External linkshttp://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-vrp-en
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
