Security Advisory - Digital Signature Verification Bypass Vulnerability in Some Huawei Routers

There is a digital signature verification bypass vulnerability in some Huawei routers. The vulnerability is due to the affected software improperly verifying digital signatures for the software image in the affected device. A local attacker with high privilege may exploit the vulnerability to bypass integrity checks for software images and install a malicious software image on the affected device. (Vulnerability ID: HWPSIRT-2019-01058)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2019-5300.

Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190320-01-ar-en