CVE-2020-36602

🗓️ 20 Sep 2022 19:42:39Reported by huaweiType

There is an out-of-bounds read and write vulnerability in some headset products. An unauthenticated attacker gets the device physically and crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message, which may be exploited to cause out-of-bounds read and write

Reporter	Title	Published	Views	Family All 10
BDU FSTEC	The vulnerability of Huawei’s microprogrammed software lies in the fact that operations are performed outside of the buffer in memory, allowing attackers to read or write arbitrary files within the system.	2 Sep 202200:00	–	bdu_fstec
CNNVD	多款Huawei产品缓冲区错误漏洞	1 Sep 202200:00	–	cnnvd
CVE	CVE-2020-36602	20 Sep 202219:42	–	cve
EUVD	EUVD-2020-24066	7 Oct 202500:30	–	euvd
Huawei	Security Advisory - Out-of-bounds Read and Write Vulnerability in Some Huawei Headset Products	1 Sep 202200:00	–	huawei
NVD	CVE-2020-36602	20 Sep 202220:15	–	nvd
Prion	Out-of-bounds	20 Sep 202220:15	–	prion
Positive Technologies	PT-2022-4598 · Huawei · Huawei Headset	1 Sep 202200:00	–	ptsecurity
RedhatCVE	CVE-2020-36602	22 May 202517:37	–	redhatcve
Vulnrichment	CVE-2020-36602	20 Sep 202219:42	–	vulnrichment

[
  {
    "product": "576up005 HOTA-CM-H-Shark-BD;577HOTA-CM-H-Shark-BD;581up-HOTA-CM-H-Shark-BD;586-HOTA-CM-H-Shark-BD;588-HOTA-CM-H-Shark-BD;606-HOTA-CM-H-Shark-BD;BI-ACC-REPORT;CM-H-Shark-BD",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.0.576-fullpackage"
      },
      {
        "status": "affected",
        "version": "1.0.0.577-fullpackage"
      },
      {
        "status": "affected",
        "version": "1.0.0.581-fullpackage"
      },
      {
        "status": "affected",
        "version": "1.0.0.586-fullpackage"
      },
      {
        "status": "affected",
        "version": "1.0.0.588-fullpackage"
      },
      {
        "status": "affected",
        "version": "1.0.0.606-fullpackage"
      },
      {
        "status": "affected",
        "version": "1.0.0.1,1.0.0.2,1.0.0.3,1.0.0.4,1.0.0.5"
      },
      {
        "status": "affected",
        "version": "1.0.0.106,1.0.0.116,1.0.0.202,1.0.0.208,1.0.0.216,1.0.0.226,1.0.0.228,1.0.0.510,1.0.0.520,1.0.0.522,1.0.0.566,1.0.0.576,1.0.0.578,1.0.0.586,1.0.0.588,1.0.0.66(VN2-SP11),1.0.0.66(VN2-SP15),1.0.0.66(VN2-SP17),1.0.0.66(VN2-SP21),1.0.0.66(VN2-SP27),1.0.0.66(VN2-SP29),1.0.0.66(VN2-SP31),1.0.0.66(VN2-SP33),1.9.0.208,1.9.0.216,1.9.0.226,1.9.0.228,1.9.0.510,1.9.0.520,1.9.0.522,1.9.0.566,1.9.0.578,1.9.0.586,1.9.0.588"
      }
    ]
  }
]

Source	Link
huawei	www.huawei.com/en/psirt/security-advisories/huawei-sa-20220826-01-outofboundread-en

20 Sep 2022 19:42Current

6.3Medium risk

Vulners AI Score6.3

EPSS0.00254