CVE-2019-19413

The CVE-2019-19413 entry describes an integer overflow in the LDAP client of Huawei products caused by insufficient input validation, exploitable by sending malformed packets to remote targets and potentially crashing the affected system. The connected Huawei security advisory HWPSIRT-2017-11033 ...

CVE-2019-19416

The CVE-2019-19416 issue concerns the SIP module in Huawei products. The vulnerability stems from insufficient verification of SIP packets, allowing a remote attacker to trigger a buffer overflow and a dead loop, resulting in a denial-of-service condition. Affected products are listed in Huawei’s...

CVE-2017-17257

CVE-2017-17257 is a memory-leak vulnerability in the H323 protocol affecting Huawei devices (e.g., AR120-S, AR1200, AR150/150-S, AR160, AR200/200-S, AR2200/2200-S, AR3200, AR3600, Secospace USG family, ViewPoint devices, and related lines). The issue arises from insufficient verification of H323 ...

CVE-2017-17258

The CVE-2017-17258 issue is a resource management vulnerability in Huawei’s H323 protocol. An unauthenticated, remote attacker can craft malformed H323 packets that, due to insufficient validation, may cause memory exhaustion and a process crash on affected devices (e.g., AR120-S/AR1200/AR150/AR2...

CVE-2017-17137

Huawei PEM module vulnerability CVE-2017-17137 is an Out-of-Bounds memory access issue caused by insufficient verification. An authenticated local attacker can trigger processing crashes by presenting a malicious certificate, resulting in denial of service. Affected products include PEM module ac...

CVE-2017-17256

CVE-2017-17256 affects Huawei H323 protocol across multiple AR and related Huawei products. An unauthenticated, remote attacker can send malformed H323 packets, and due to insufficient packet verification a memory leak may occur, potentially causing DoS. Public details in Huawei HWPSIRT advisory ...

CVE-2019-19414

CVE-2019-19414 is an integer overflow vulnerability in the LDAP server of Huawei products caused by insufficient input validation. A remote attacker could exploit malformed LDAP packets to crash the affected system. The Huawei security advisory HWPSIRT-2017-11034/2020-01-15-01-ldap notes fixes vi...

CVE-2019-19417

CVE-2019-19417 (and related CVEs CVE-2019-19415/19416) describe three DoS vulnerabilities in the SIP module of some Huawei products. The root cause is insufficient verification of SIP packets, which can cause buffer overflow and a dead loop, enabling a remote attacker to trigger a DoS condition o...

CVE-2017-17135

CVE-2017-17135 is a null pointer reference vulnerability in the PEM module of Huawei products, including DP300 family, IPS, NGFW, NIP, S-series, Secospace USG, ViewPoint, TE, TP, USG9500, and related models, due to insufficient verification. An authenticated local attacker can call the PEM decode...

CVE-2017-17251

CVE-2017-17251 is a Huawei H323 protocol null pointer dereference vulnerability affecting multiple Huawei devices (e.g., AR120-S/AR1200/AR150/AR200-series, DR modules, Secospace USG, ViewPoint, etc.). Root cause: insufficient validation of H323 packets leading to a null pointer dereference and po...

CVE-2017-17254

This CVE-2017-17254 is a Huawei H323 protocol null pointer dereference vulnerability affecting a broad range of Huawei devices (e.g., AR120S/AR1200/AR150/AR200 families and related platforms). An unauthenticated, remote attacker can craft malformed H323 packets and send them to affected devices, ...

CVE-2017-17252

CVE-2017-17252 corresponds to an out-of-bounds read vulnerability in Huawei UTP/H323 protocol support affecting a broad set of Huawei AR/AR- series and related devices (e.g., AR120-S/AR1200/AR150/AR200, ViewPoint/Secospace lines). An unauthenticated remote attacker can send malformed H323 packets...

CVE-2017-17281

The CVE-2017-17281 entry affects Huawei SFTP module in multiple products (e.g., Huawei DP300: V500R002C00; RP200: V600R006C00; TE30: V100R001C10; TE40/TE50/TE60: V500R002C00; V600R006C00 variants). The root cause is an out-of-bounds read in the SFTP component, allowing a remote, authenticated att...

CVE-2017-17296

CVE-2017-17296 describes a memory leak vulnerability in Huawei products (e.g., AR120-S/AR1200/AR150 family and others) caused by not freeing allocated memory when handling H323 packages. An unauthenticated remote attacker can send crafted H323 messages, potentially causing memory leakage and serv...

CVE-2019-19415

CVE-2019-19415 (and related CVEs 19416/19417) affect the SIP module in some Huawei products. The DoS vulnerabilities arise from three issues where insufficient packet verification can lead to a buffer overflow and a dead loop, exploitable remotely by sending specially crafted messages to affected...

CVE-2017-17144

The CVE-2017-17144 issue affects Huawei SIP module backups on multiple products (e.g., DP300/TE-series, ViewPoint, eSpace, etc.). The vulnerability is an overflow in the SIP backup feature when the module processes a specific amount of state, which the module cannot handle, resulting in a denial ...

CVE-2017-17293

CVE-2017-17293 affects Huawei AR/SRG products (e.g., AR120-S, AR1200, AR150, AR200, AR2200, SRG1300/2300/3300, TE/DP300, MAX PRESENCE, NetEngine, RP200, etc.). A crafted XML file can be submitted to vulnerable devices, exploiting insufficient input validation to trigger a buffer overflow. An auth...

CVE-2017-17294

CVE-2017-17294 describes a null pointer dereference in a broad set of Huawei enterprise router products (e.g., AR-series and SRG/NetEngine lines) caused by insufficient input validation when processing a crafted XML file. An authenticated, local attacker can trigger this by uploading a tailored X...

CVE-2017-17314

The CVE-2017-17314 issue affects Huawei DP300, RP200, TE30/TE40/TE50/TE60 platforms (versions listed in the initial entry). It is an invalid memory access vulnerability caused by insufficient input validation of certain fields in malformed SCCP messages, which unauthenticated attackers can send t...

CVE-2017-15331

CVE-2017-15331 corresponds to an out-of-bounds read vulnerability in the H323 protocol affecting a wide range of Huawei products (AR, ARS/RG series, NIP6300/6600, Secospace USG, ViewPoint 9030, and related platforms). The issue arises from insufficient verification of H323 messages, allowing an u...

CVE-2017-15350

The CVE-2017-15350 entry concerns a buffer overflow in the Common Open Policy Service (COPS) module of Huawei devices (e.g., DP300, USG/NGFW modules, NIP/TP/V series, TE/TP lines, etc.). Root cause: insufficient input validation on COPS messages, allowing an unauthenticated, remote attacker to se...

CVE-2017-17151

CVE-2017-17151 affects Huawei H323 implementations (e.g., AR100/AR100-S/AR110-S/AR120/AR120-S/AR1200/AR1200-S/AR150/AR150-S/AR160/AR200/AR200-S/AR2200/AR2200-S/AR3200/AR510/DP300/NetEngine16EX/RP200/SRG1300/SRG2300/SRG3300/TE30/TE40/TE50/TE60/TP3106/TP3206/ViewPoint 8660/ViewPoint 9030). The root...

CVE-2017-17297

CVE-2017-17297 corresponds to a buffer overflow vulnerability affecting Huawei devices such as AR120-S, AR1200/AR1200-S, AR150/AR150-S, AR160, AR200/AR200-S, AR2200/AR2200-S, AR3200, AR3600, and related modules (e.g., IPS, NGFW, NetEngine family) across multiple firmware versions (e.g., V200R006C...

CVE-2017-15339

The CVE-2017-15339 entry documents a buffer overflow vulnerability in Huawei SIP modules across many devices (e.g., DP300, IPS, NGFW, NIP/N series, USG/SeCOSpace, ViewPoint, Te series). Root cause: insufficient validation of SIP messages, enabling overflow when crafting specific SIP messages. Imp...

CVE-2017-17138

CVE-2017-17138 is a DoS in the Huawei PEM module caused by insufficient verification, where an authenticated local attacker can trigger a deadloop by presenting a malicious certificate. Affected Huawei products include DP300, IPS, NGFW, NIP6300/6600, RP200, S-series (S12700, S1700, S2700, S5700, ...

CVE-2017-17142

CVE-2017-17142 is an overflow vulnerability in the SIP module of Huawei devices (e.g., Huawei DP300, RP200, RSE6500, TE3x/TE6x, ViewPoint 9030, eSpace U1960/U1981, among others). An attacker can exploit it by sending a specially crafted SIP message, causing a process to reboot at random and impac...

CVE-2017-15332

CVE-2017-15332 corresponds to a memory-leak vulnerability in the H323 protocol across multiple Huawei products (e.g., AR, ARS, SRG, NetEngine, Secospace USG, etc.). The issue arises from insufficient verification/checks of H323 packets, allowing an unauthenticated, remote attacker to send crafted...

CVE-2017-15335

CVE-2017-15335 describes a buffer overflow vulnerability in the SIP backup feature across multiple Huawei devices (DP300, NGFW/IPS modules, USG/Secospace, and related platforms). The root cause is insufficient validation of SIP message values, allowing specially crafted messages to trigger a cras...

CVE-2017-15353

Concrete details exist: CVE-2017-15353 affects Huawei DP300, ViewPoint series and other listed endpoints (e.g., V500R002C00, V600R006C00, TE30/TE40/TE50/TE60, TX50, VP9660, ViewPoint 8660/9030, etc.). Root cause is out-of-bounds read due to insufficient input validation, requiring an attacker to ...

CVE-2017-17143

CVE-2017-17143 is a Huawei SIP module overflow vulnerability. The issue occurs when validating certain SIP messages, where the module cannot parse malformed inputs, potentially allowing an attacker to trigger a random process reboot. Affected products include Huawei DP300 family (and related RP20...

CVE-2017-17253

CVE-2017-17253 describes an out-of-bounds read in Huawei’s H323 protocol across multiple Huawei products (e.g., AR120-S/AR1200 series, AR150, AR160, AR200/AR2200/AR3200/AR3600 line, DP300, Secospace USG, ViewPoint devices, etc.). An unauthenticated, remote attacker can craft malformed H323 packet...

CVE-2017-15336

CVE-2017-15336 corresponds to buffer overflow vulnerabilities in the SIP backup feature across Huawei devices (DP300 and a broad range of modules and platforms including IPS, NGFW, NIP6300/6600/6800, RP200, ViewPoint, eSpace U1981, and Secospace USG/TE series). Root cause: insufficient validation...

CVE-2017-17184

CVE-2017-17184 affects Huawei DP300/RP200/V600R006/TE30/TE40/TE50/TE60 etc. affected components: SOAP handling with insufficient input validation leading to an integer overflow when processing malformed SOAP packets by an authenticated, remote attacker; potential to reset a process (partial avail...

CVE-2017-17289

CVE-2017-17289 describes a memory-leak vulnerability in Huawei devices (e.g., DP300, RP200, TE/VM series) when processing XML data. The issue arises from failure to properly free allocated memory, enabling an authenticated, local attacker to repeatedly upload crafted XML files, potentially causin...

CVE-2017-17310

The CVE-2017-17310 vulnerability affects Huawei ENUM (Electronic Numbers to URI Mapping) module in multiple devices (DP300, RP200, TE30, TE40, TE50, TE60 with various V/R versions). The root cause is insufficient verification of values in specially crafted ENUM packets, allowing an unauthenticate...

CVE-2017-17186

CVE-2017-17186 affects Huawei devices (e.g., DP300, RP200, V500R002C00/V600R006C00, TE30/TE40/TE50/TE60) with a DoS due to insufficient input validation in SOAP handling. An authenticated, remote attacker can send malformed SOAP packets, potentially overwriting data, leaking memory, and causing a...

CVE-2017-17199

CVE-2017-17199 affects Huawei DP300, RP200, V500R002C00/V600R006C00, TE30/TE40/TE50/TE60 series; the issue is an out-of-bounds read caused by improper processing of malformed H323 messages. A remote attacker控制 a server can send malformed H323 reply messages to a target device, potentially causing...

CVE-2017-17255

CVE-2017-17255 is a null pointer dereference vulnerability in Huawei’s H323 protocol across numerous AR/ARS/DP/NIP/NGFW/USG/ViewPoint devices. The root cause is insufficient validation of H323 packets, allowing an unauthenticated, remote attacker to send malformed packets that cause a process cra...

CVE-2017-15337

CVE-2017-15337 affects the SIP module across multiple Huawei products (DP300, IPS, NGFW, NIP, NIP6600/6800, RP200, SVN series, Secospace USG, TE/Views, eSpace U1981, ViewPoint, etc.). The root cause is insufficient validation of SIP messages, leading to a buffer overflow if an attacker crafts spe...

CVE-2017-15354

The CVE-2017-15354 entry describes a buffer overflow in Huawei devices (DP300, RP200, TE/TX/V series in various revisions) caused by insufficient input validation of three HTTP message parameters. This could allow an attacker to send specially crafted HTTP requests and cause service abnormalities...

CVE-2017-17182

CVE-2017-17182 affects Huawei DP300, RP200, V600R006C00, TE30/TE40/TE50/TE60 variants with out-of-bounds read due to insufficient input validation. An authenticated, remote attacker can send malformed SOAP packets to cause the device to access invalid memory and potentially reset a process. The v...

CVE-2017-17185

CVE-2017-17185 affects Huawei DP300, RP200, V600R006C00 and related TE/V series devices; an authenticated, remote attacker could send malformed SOAP packets due to insufficient input validation, causing an out-of-bounds read and potential process reset. Huawei’s security advisory (and CNVD/NVD en...

CVE-2017-17200

CVE-2017-17200 affects Huawei DP300, RP200, V600R006C00, TE30/TE40/TE50/TE60 and V500R002C00/V600R006C00/V100R001C10 variants. Root cause: out-of-bounds read due to improper processing of malformed H.323 messages. Impact: remote attacker can send crafted H.323 replies to a target device over the ...

CVE-2017-17295

CVE-2017-17295 describes buffer overflow vulnerabilities in numerous Huawei products caused by insufficient validation of SIP package values. An unauthenticated, remote attacker may send crafted SIP packages to affected devices (e.g., AR120-S, AR1200, AR150/AR200 families and others listed) to tr...

CVE-2017-17134

The CVE-2017-17134 issue affects Huawei devices (DP300, RP200, V600R006C00, TE30/40/50/60, V500R002C00, etc.) where the XML parser fails to properly validate specially crafted XML files. The root cause is improper handling during parsing, leading to a null pointer dereference that can be triggere...

CVE-2017-17136

The CVE-2017-17136 issue is a heap overflow in Huawei’s PEM module across multiple products (e.g., DP300, IPS, NGFW, S series, USG, ViewPoint, etc.). Root cause: insufficient verification in the PEM processing flow, allowing an authenticated local attacker to crash the process by presenting a cra...

CVE-2017-17216

The CVE-2017-17216 entry concerns an out-of-bounds read in MGCP handling on Huawei devices (DP300, RP200, TE series, etc.). The root cause is insufficient validation of MGCP packets, allowing an unauthenticated, remote attacker to send malformed parameters that may trigger a process reboot. Conne...

CVE-2017-17292

CVE-2017-17292 affects Huawei AR/X routers (e.g., AR120-S/AR200/AR3200, SRG/Te series, etc.) and related hardware listed in the CVE description. The vulnerability is a denial-of-service caused by improper handling of input when processing a crafted XML file uploaded to the affected module by an a...

CVE-2017-17317

The CVE-2017-17317 entry concerns a buffer overflow in the Common Open Policy Service (COPS) module of Huawei devices (e.g., USG6300, Secospace USG6500/6600, TE/ V series). Root cause: insufficient input validation in the COPS module, allowing an unauthenticated, remote attacker who can control t...

CVE-2017-15334

CVE-2017-15334 pertains to a buffer overflow in the SIP backup feature across many Huawei products (DP300, multiple modules and devices). The root cause is insufficient validation of certain SIP message values, allowing an attacker to send specially crafted messages to trigger a service abnormali...