Improper access control in Huawei products - CVE-2020-1860
Published: February 19, 2020
Vulnerability identifier: #VU25430
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-1860
CWE-ID: CWE-284
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote attacker on the local network can bypass implemented security restrictions and directly access the Internet.
Affected software
Huawei NIP6800
Huawei Secospace USG6600
USG9500
Huawei Secospace USG6600
USG9500
How to mitigate CVE-2020-1860
Install updates from vendor's website.
Huawei NIP6800 - update to V500R005C20SPC300
Huawei Secospace USG6600 - update to V500R005C20SPC300
USG9500 - update to V500R005C20SPC300
Huawei Secospace USG6600 - update to V500R005C20SPC300
USG9500 - update to V500R005C20SPC300