Lucene search

HuaweiCVE-2017-17186

HistoryFeb 15, 2018 - 4:29 p.m.

CVE-2017-17186

2018-02-1516:29:02

CWE-20

huawei

web.nvd.nist.gov

huawei

cve-2017-17186

vulnerability

dos

soap

input validation

data overwritten

memory leak

process reset

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

41.5%

JSON

Huawei DP300 V500R002C00, RP200 V500R002C00, V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V100R001C10, V500R002C00, V600R006C00 have a DoS vulnerability. Due to insufficient input validation, an authenticated, remote attacker could send malformed SOAP packets to the target device. Successful exploit could make some data overwritten, leak device memory and potentially reset a process.

Affected configurations

Nvd

Vulners

Node

huaweidp300_firmwareMatchv500r002c00

AND

huaweidp300Match-

Node

huaweirp200_firmwareMatchv500r002c00

huaweirp200_firmwareMatchv600r006c00

AND

huaweirp200Match-

Node

huaweite30_firmwareMatchv100r001c10

huaweite30_firmwareMatchv500r002c00

huaweite30_firmwareMatchv600r006c00

AND

huaweite30Match-

Node

huaweite40_firmwareMatchv500r002c00

huaweite40_firmwareMatchv600r006c00

AND

huaweite40Match-

Node

huaweite50_firmwareMatchv500r002c00

huaweite50_firmwareMatchv600r006c00

AND

huaweite50Match-

Node

huaweite60_firmwareMatchv100r001c10

huaweite60_firmwareMatchv500r002c00

huaweite60_firmwareMatchv600r006c00

AND

huaweite60Match-

VendorProductVersionCPE
huaweidp300_firmwarev500r002c00cpe:2.3:o:huawei:dp300_firmware:v500r002c00:*:*:*:*:*:*:*
huaweidp300-cpe:2.3:h:huawei:dp300:-:*:*:*:*:*:*:*
huaweirp200_firmwarev500r002c00cpe:2.3:o:huawei:rp200_firmware:v500r002c00:*:*:*:*:*:*:*
huaweirp200_firmwarev600r006c00cpe:2.3:o:huawei:rp200_firmware:v600r006c00:*:*:*:*:*:*:*
huaweirp200-cpe:2.3:h:huawei:rp200:-:*:*:*:*:*:*:*
huaweite30_firmwarev100r001c10cpe:2.3:o:huawei:te30_firmware:v100r001c10:*:*:*:*:*:*:*
huaweite30_firmwarev500r002c00cpe:2.3:o:huawei:te30_firmware:v500r002c00:*:*:*:*:*:*:*
huaweite30_firmwarev600r006c00cpe:2.3:o:huawei:te30_firmware:v600r006c00:*:*:*:*:*:*:*
huaweite30-cpe:2.3:h:huawei:te30:-:*:*:*:*:*:*:*
huaweite40_firmwarev500r002c00cpe:2.3:o:huawei:te40_firmware:v500r002c00:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	dp300_firmware	v500r002c00	cpe:2.3:o:huawei:dp300_firmware:v500r002c00:::::::*
huawei	dp300	-	cpe:2.3:h:huawei:dp300:-:::::::*
huawei	rp200_firmware	v500r002c00	cpe:2.3:o:huawei:rp200_firmware:v500r002c00:::::::*
huawei	rp200_firmware	v600r006c00	cpe:2.3:o:huawei:rp200_firmware:v600r006c00:::::::*
huawei	rp200	-	cpe:2.3:h:huawei:rp200:-:::::::*
huawei	te30_firmware	v100r001c10	cpe:2.3:o:huawei:te30_firmware:v100r001c10:::::::*
huawei	te30_firmware	v500r002c00	cpe:2.3:o:huawei:te30_firmware:v500r002c00:::::::*
huawei	te30_firmware	v600r006c00	cpe:2.3:o:huawei:te30_firmware:v600r006c00:::::::*
huawei	te30	-	cpe:2.3:h:huawei:te30:-:::::::*
huawei	te40_firmware	v500r002c00	cpe:2.3:o:huawei:te40_firmware:v500r002c00:::::::*

Rows per page:

1-10 of 191

CNA Affected

[
  {
    "product": "DP300,RP200,TE30,TE40,TE50,TE60",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "DP300 V500R002C00, RP200 V500R002C00,V600R006C00, TE30 V100R001C10,V500R002C00,V600R006C00, TE40 V500R002C00,V600R006C00, TE50 V500R002C00,V600R006C00, TE60 V100R001C10,V500R002C00,V600R006C00"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20180207-01-soap-en

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

41.5%

JSON

Related for CVE-2017-17186