Lucene search

[email protected]CVE-2019-5268

HistoryNov 29, 2019 - 9:15 p.m.

CVE-2019-5268

2019-11-2921:15:11

CWE-20

[email protected]

web.nvd.nist.gov

huawei

home routers

input validation

vulnerability

attacker

files

upload

directories

4.8 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:A/AC:L/Au:N/C:P/I:P/A:N

8.1 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.8%

JSON

Some Huawei home routers have an input validation vulnerability. Due to input parameter is not correctly verified, an attacker can exploit this vulnerability by sending special constructed packets to obtain files in the device and upload files to some directories.

Affected configurations

NVD

Node

huaweicd10-10_firmwareRange10.0.2.2–10.0.2.7

AND

huaweicd10-10Match-

Node

huaweicd16-10_firmwareRange10.0.2.3–10.0.2.5

AND

huaweicd16-10Match-

Node

huaweicd17-10_firmwareRange9.0.3.3–10.0.2.5

AND

huaweicd17-10Match-

Node

huaweicd18-10_firmwareRange9.0.2.23–10.0.2.5

AND

huaweicd18-10Match-

Node

huaweihirouter-cd15-10_firmwareRange9.0.2.3–10.0.2.5

AND

huaweihirouter-cd15-10Match-

Node

huaweihirouter-cd20-10_firmwareRange9.0.3.9–10.0.2.6

AND

huaweihirouter-cd20-10Match-

Node

huaweihirouter-cd21-16_firmwareRange9.0.3.9–10.0.2.5

AND

huaweihirouter-cd21-16Match-

Node

huaweihirouter-cd30-10_firmwareRange10.0.2.8–10.0.2.9

AND

huaweihirouter-cd30-10Match-

Node

huaweihirouter-cd30-11_firmwareRange10.0.2.8–10.0.2.9

AND

huaweihirouter-cd30-11Match-

Node

huaweihirouter-h1-10_firmwareRange9.0.3.11–10.0.2.5

AND

huaweihirouter-h1-10Match-

Node

huaweitc5200-10_firmwareRange10.0.2.3–10.0.2.5

AND

huaweitc5200-10Match-

Node

huaweiws5100-10_firmwareRange9.0.3.11–10.0.2.7

AND

huaweiws5100-10Match-

Node

huaweiws5102-10_firmwareRange10.0.2.2–10.0.2.7

AND

huaweiws5102-10Match-

Node

huaweiws5106-10_firmwareRange10.0.2.2–10.0.2.7

AND

huaweiws5106-10Match-

Node

huaweiws5108-10_firmwareRange10.0.2.2–10.0.2.7

AND

huaweiws5108-10Match-

Node

huaweiws5200-10_firmwareRange9.0.3.9–10.0.2.6

AND

huaweiws5200-10Match-

Node

huaweiws5200-11_firmwareMatch9.0.3.11

huaweiws5200-11_firmwareMatch10.0.2.3

AND

huaweiws5200-11Match-

Node

huaweiws5280-10_firmwareRange9.0.3.22–10.0.2.6

AND

huaweiws5280-10Match-

Node

huaweiws5280-11_firmwareRange9.0.3.22–10.0.2.6

AND

huaweiws5280-11Match-

Node

huaweiws6500-10_firmwareRange10.0.2.3–10.0.2.5

AND

huaweiws6500-10Match-

Node

huaweiws6500-11_firmwareRange10.0.2.2–10.0.2.7

AND

huaweiws6500-11Match-

Node

huaweiws826-10_firmwareRange9.0.3.11–10.0.2.5

AND

huaweiws826-10Match-

CPENameOperatorVersion
huawei:cd10-10_firmwarehuawei cd10-10 firmwarelt10.0.2.7

CPE	Name	Operator	Version
huawei:cd10-10_firmware	huawei cd10-10 firmware	lt	10.0.2.7

CNA Affected

[
  {
    "product": "CD10-10, CD16-10, CD17-10, CD18-10, HiRouter-CD15-10, HiRouter-CD20-10, HiRouter-CD21-16, HiRouter-CD30-10, HiRouter-CD30-11, HiRouter-H1-10, TC5200-10, WS5100-10, WS5102-10, WS5106-10, WS5108-10, WS5200-10, WS5200-11, , WS5280-10, WS5280-11, WS6500-10, WS6500-11, WS826-10",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "10.0.2.2, 10.0.2.3, 9.0.3.3, 9.0.2.23, 9.0.2.3, 9.0.3.9, 10.0.2.8, 9.0.3.11, 9.0.3.22"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20191113-01-homerouter-en

4.8 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:A/AC:L/Au:N/C:P/I:P/A:N

8.1 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

7.9 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.8%

JSON

Related for CVE-2019-5268

prion1 nvd1 cvelist1 huawei1