Lucene search

[email protected]CVE-2020-9067

HistoryApr 02, 2020 - 9:15 p.m.

CVE-2020-9067

2020-04-0221:15:13

CWE-120

[email protected]

web.nvd.nist.gov

huawei

buffer overflow

vulnerability

remote code execution

smartax

ma5600t

ma5800

ea5800

cve-2020-9067

nvd

5.2 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:S/C:P/I:P/A:P

8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.9%

JSON

There is a buffer overflow vulnerability in some Huawei products. The vulnerability can be exploited by an attacker to perform remote code execution on the affected products when the affected product functions as an optical line terminal (OLT). Affected product versions include:SmartAX MA5600T versions V800R013C10, V800R015C00, V800R015C10, V800R017C00, V800R017C10, V800R018C00, V800R018C10; SmartAX MA5800 versions V100R017C00, V100R017C10, V100R018C00, V100R018C10, V100R019C10; SmartAX EA5800 versions V100R018C00, V100R018C10, V100R019C10.

Affected configurations

NVD

Node

huaweismartax_ma5600tMatch-

AND

huaweismartax_ma5600t_firmwareMatchv800r013c10

huaweismartax_ma5600t_firmwareMatchv800r015c00

huaweismartax_ma5600t_firmwareMatchv800r015c10

huaweismartax_ma5600t_firmwareMatchv800r017c00

huaweismartax_ma5600t_firmwareMatchv800r017c10

huaweismartax_ma5600t_firmwareMatchv800r018c00

huaweismartax_ma5600t_firmwareMatchv800r018c10

Node

huaweismartax_ma5800Match-

AND

huaweismartax_ma5800_firmwareMatchv100r017c00

huaweismartax_ma5800_firmwareMatchv100r017c10

huaweismartax_ma5800_firmwareMatchv100r018c00

huaweismartax_ma5800_firmwareMatchv100r018c10

huaweismartax_ma5800_firmwareMatchv100r019c10

Node

huaweismartax_ea5800_firmwareMatchv100r018c00

huaweismartax_ea5800_firmwareMatchv100r018c10

huaweismartax_ea5800_firmwareMatchv100r019c10

AND

huaweismartax_ea5800Match-

CPENameOperatorVersion
huawei:smartax_ma5600t_firmwarehuawei smartax ma5600t firmwareeqv800r013c10
huawei:smartax_ma5600t_firmwarehuawei smartax ma5600t firmwareeqv800r015c00
huawei:smartax_ma5600t_firmwarehuawei smartax ma5600t firmwareeqv800r015c10
huawei:smartax_ma5600t_firmwarehuawei smartax ma5600t firmwareeqv800r017c00
huawei:smartax_ma5600t_firmwarehuawei smartax ma5600t firmwareeqv800r017c10
huawei:smartax_ma5600t_firmwarehuawei smartax ma5600t firmwareeqv800r018c00
huawei:smartax_ma5600t_firmwarehuawei smartax ma5600t firmwareeqv800r018c10

CPE	Name	Operator	Version
huawei:smartax_ma5600t_firmware	huawei smartax ma5600t firmware	eq	v800r013c10
huawei:smartax_ma5600t_firmware	huawei smartax ma5600t firmware	eq	v800r015c00
huawei:smartax_ma5600t_firmware	huawei smartax ma5600t firmware	eq	v800r015c10
huawei:smartax_ma5600t_firmware	huawei smartax ma5600t firmware	eq	v800r017c00
huawei:smartax_ma5600t_firmware	huawei smartax ma5600t firmware	eq	v800r017c10
huawei:smartax_ma5600t_firmware	huawei smartax ma5600t firmware	eq	v800r018c00
huawei:smartax_ma5600t_firmware	huawei smartax ma5600t firmware	eq	v800r018c10

CNA Affected

[
  {
    "product": "SmartAX MA5600T",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "V800R013C10"
      },
      {
        "status": "affected",
        "version": "V800R015C00"
      },
      {
        "status": "affected",
        "version": "V800R015C10"
      },
      {
        "status": "affected",
        "version": "V800R017C00"
      },
      {
        "status": "affected",
        "version": "V800R017C10"
      },
      {
        "status": "affected",
        "version": "V800R018C00"
      },
      {
        "status": "affected",
        "version": "V800R018C10"
      }
    ]
  },
  {
    "product": "SmartAX MA5800",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "V100R017C00"
      },
      {
        "status": "affected",
        "version": "V100R017C10"
      },
      {
        "status": "affected",
        "version": "V100R018C00"
      },
      {
        "status": "affected",
        "version": "V100R018C10"
      },
      {
        "status": "affected",
        "version": "V100R019C10"
      }
    ]
  },
  {
    "product": "SmartAX EA5800",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "V100R018C00"
      },
      {
        "status": "affected",
        "version": "V100R018C10"
      },
      {
        "status": "affected",
        "version": "V100R019C10"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20200401-01-overflow-en

5.2 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:S/C:P/I:P/A:P

8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.9%

JSON

Related for CVE-2020-9067

nvd1 prion1 cvelist1 huawei1