Insufficient verification of data authenticity in Huawei products - CVE-2019-5291

Vulnerability identifier: #VU23419

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-5291

CWE-ID: CWE-345

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause the target device abnormal.

The vulnerability exists due to the target system does not verify certain parameters sufficiently. A remote attacker can intercept specific packets between two devices, modify the packets, send the modified packets to the peer device and cause the target device abnormal.

Huawei CloudEngine 12800
Huawei AR1200
Huawei AR200
Huawei AR200-S
Huawei AR2200
Huawei AR160
Huawei AR120-S
Huawei AR2200-S
Huawei AR150-S
Huawei AR3200
Huawei AR150
Huawei NetEngine16EX
Huawei SRG1300
Huawei AR1200-S
Huawei SRG2300
Huawei SRG3300
Huawei AR3600
Huawei S6700

Install updates from vendor's website.

Huawei CloudEngine 12800 - update to V200R02C5SPC800
Huawei AR1200 - update to V200R009C00SPC500
Huawei AR200 - update to V200R009C00SPC500
Huawei AR200-S - update to V200R009C00SPC500
Huawei AR2200 - update to V200R009C00SPC500
Huawei AR160 - update to V200R009C00SPC500
Huawei AR120-S - update to V200R009C00SPC500
Huawei AR2200-S - update to V200R009C00SPC500
Huawei AR150-S - update to V200R009C00SPC500
Huawei AR3200 - update to V200R009C00SPC500
Huawei AR150 - update to V200R009C00SPC500
Huawei NetEngine16EX - update to V200R009C00SPC500
Huawei SRG1300 - update to V200R009C00SPC500
Huawei AR1200-S - update to V200R009C00SPC500
Huawei SRG2300 - update to V200R009C00SPC500
Huawei SRG3300 - update to V200R009C00SPC500
Huawei AR3600 - update to V200R009C00SPC500
Huawei S6700 - update to V2R11C10

• https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-validation-en

• Insufficient verification of data authenticity in several Huawei Products