Lucene search

HuaweiCVE-2017-17148

HistoryMar 09, 2018 - 5:29 p.m.

CVE-2017-17148

2018-03-0917:29:00

CWE-20

huawei

web.nvd.nist.gov

huawei

dp300

v500r002c00

dos

vulnerability

authentication

local attacker

xml

malloc

nvd

CVSS2

4.9

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

5.2

Confidence

High

EPSS

Percentile

5.1%

JSON

Huawei DP300 V500R002C00 have a DoS vulnerability due to the lack of validation when the malloc is called. An authenticated local attacker can craft specific XML files to the affected products and parse this file, which result in DoS attacks.

Affected configurations

Nvd

Vulners

Node

huaweidp300_firmwareRange≤v500r002c00

AND

huaweidp300Match-

VendorProductVersionCPE
huaweidp300_firmware*cpe:2.3:o:huawei:dp300_firmware:*:*:*:*:*:*:*:*
huaweidp300-cpe:2.3:h:huawei:dp300:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	dp300_firmware	*	cpe:2.3:o:huawei:dp300_firmware::::::::
huawei	dp300	-	cpe:2.3:h:huawei:dp300:-:::::::*

CNA Affected

[
  {
    "product": "DP300",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "V500R002C00"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20171215-01-xml-en

CVSS2

4.9

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

5.2

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2017-17148