Lucene search

[email protected]CVE-2017-15343

HistoryFeb 15, 2018 - 4:29 p.m.

CVE-2017-15343

2018-02-1516:29:00

CWE-190

[email protected]

web.nvd.nist.gov

huawei

ar3200

v200r006c10

v200r006c11

v200r007c00

v200r007c01

v200r007c02

v200r008c00

v200r008c10

v200r008c20

v200r008c30

integer overflow vulnerability

remote attacker

crafted sctp messages

system reboot

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.6 High

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.002 Low

EPSS

Percentile

58.9%

JSON

Huawei AR3200 with software V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20, V200R008C30 has an integer overflow vulnerability. The software does not sufficiently validate certain field in SCTP messages, a remote unauthenticated attacker could send a crafted SCTP message to the device. Successful exploit could system reboot.

CPENameOperatorVersion
huawei:ar120-s_firmwarehuawei ar120-s firmwareeqv200r006c10
huawei:ar120-s_firmwarehuawei ar120-s firmwareeqv200r007c00
huawei:ar120-s_firmwarehuawei ar120-s firmwareeqv200r008c20
huawei:ar120-s_firmwarehuawei ar120-s firmwareeqv200r008c30
huawei:ar1200_firmwarehuawei ar1200 firmwareeqv200r007c01
huawei:ar1200_firmwarehuawei ar1200 firmwareeqv200r007c02
huawei:ar3200_firmwarehuawei ar3200 firmwareeqv200r006c11
huawei:ar3200_firmwarehuawei ar3200 firmwareeqv200r008c00
huawei:ar3200_firmwarehuawei ar3200 firmwareeqv200r008c10

CPE	Name	Operator	Version
huawei:ar120-s_firmware	huawei ar120-s firmware	eq	v200r006c10
huawei:ar120-s_firmware	huawei ar120-s firmware	eq	v200r007c00
huawei:ar120-s_firmware	huawei ar120-s firmware	eq	v200r008c20
huawei:ar120-s_firmware	huawei ar120-s firmware	eq	v200r008c30
huawei:ar1200_firmware	huawei ar1200 firmware	eq	v200r007c01
huawei:ar1200_firmware	huawei ar1200 firmware	eq	v200r007c02
huawei:ar3200_firmware	huawei ar3200 firmware	eq	v200r006c11
huawei:ar3200_firmware	huawei ar3200 firmware	eq	v200r008c00
huawei:ar3200_firmware	huawei ar3200 firmware	eq	v200r008c10

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20171129-01-sctp-en

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.6 High

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.002 Low

EPSS

Percentile

58.9%

JSON

Related for CVE-2017-15343

prion1 huawei1 cvelist1