Multiple vulnerabilities in Some Huawei Products



Published: 2020-12-02 | Updated: 2021-01-04
Risk Low
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2020-9137
CVE-2020-1865
CWE-ID CWE-264
CWE-125
Exploitation vector Local network
Public exploit N/A
Vulnerable software
Subscribe
Huawei CloudEngine 12800
Hardware solutions / Firmware

Huawei CloudEngine 5800
Hardware solutions / Routers & switches, VoIP, GSM, etc

Huawei CloudEngine 6800
Hardware solutions / Routers & switches, VoIP, GSM, etc

Huawei CloudEngine 7800
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor Huawei

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

Updated 04.01.2021
Added vulnerability #2

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU48749

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-9137

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local administrator to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions, which leads to security restrictions bypass and privilege escalation.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Huawei CloudEngine 12800: V200R002C50SPC800 - V200R019C10SPC800

Huawei CloudEngine 5800: V200R002C50SPC800 - V200R019C10SPC800

Huawei CloudEngine 6800: V200R002C50SPC800 - V200R019C10SPC800

Huawei CloudEngine 7800: V200R002C50SPC800 - V200R019C10SPC800

External links

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201202-02-privilege-en


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds read

EUVDB-ID: #VU49226

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-1865

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition. A remote attacker on the local network can trigger out-of-bounds read error and cause a denial of service condition on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Huawei CloudEngine 12800: V200R002C50SPC800 - V200R019C10SPC800

Huawei CloudEngine 5800: V200R002C50SPC800 - V200R019C10SPC800

Huawei CloudEngine 6800: V200R002C50SPC800 - V200R019C10SPC800

Huawei CloudEngine 7800: V200R002C50SPC800 - V200R019C10SPC800

External links

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201230-02-cloudengine-en


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###