Insufficient verification of data authenticity in Huawei products - CVE-2020-1855

Vulnerability identifier: #VU24513

CSH Severity: Low

CVSS v4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-1855

CWE-ID: CWE-345

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to cause the target device abnormal.

The vulnerability exists due to an insufficient verification issue. An attacker with physical access can tamper with device information and cause service abnormal.

Huawei HEGE-570
Huawei HEGE-560
OSCA-550
OSCA-550A
OSCA-550AX
OSCA-550X

Install updates from vendor's website.

Huawei HEGE-560 - update to 1.0.1.1.23(SP2)
OSCA-550 - update to 1.0.1.1.23(SP2)
OSCA-550A - update to 1.0.1.1.23(SP2)
OSCA-550AX - update to 1.0.1.1.23(SP2)
OSCA-550X - update to 1.0.1.1.23(SP2)

• https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-03-osca-en

• Insufficient verification of data authenticity in Some Huawei Products