Lucene search

[email protected]CVE-2017-15344

HistoryFeb 15, 2018 - 4:29 p.m.

CVE-2017-15344

2018-02-1516:29:00

CWE-190

[email protected]

web.nvd.nist.gov

huawei

ar3200

software

vulnerability

integer overflow

remote attack

unauthenticated

system reboot

nvd

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.2%

JSON

Huawei AR3200 with software V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20, V200R008C30 has an integer overflow vulnerability. The software does not sufficiently validate certain field in SCTP messages, a remote unauthenticated attacker could send a crafted SCTP message to the device. Successful exploit could cause system reboot.

Affected configurations

NVD

Node

huaweiar120-s_firmwareMatchv200r006c10

huaweiar120-s_firmwareMatchv200r007c00

huaweiar120-s_firmwareMatchv200r008c20

huaweiar120-s_firmwareMatchv200r008c30

huaweiar1200_firmwareMatchv200r007c01

huaweiar1200_firmwareMatchv200r007c02

huaweiar3200_firmwareMatchv200r006c11

huaweiar3200_firmwareMatchv200r008c00

huaweiar3200_firmwareMatchv200r008c10

AND

huaweiar3200Match-

CPENameOperatorVersion
huawei:ar120-s_firmwarehuawei ar120-s firmwareeqv200r006c10
huawei:ar120-s_firmwarehuawei ar120-s firmwareeqv200r007c00
huawei:ar120-s_firmwarehuawei ar120-s firmwareeqv200r008c20
huawei:ar120-s_firmwarehuawei ar120-s firmwareeqv200r008c30
huawei:ar1200_firmwarehuawei ar1200 firmwareeqv200r007c01
huawei:ar1200_firmwarehuawei ar1200 firmwareeqv200r007c02
huawei:ar3200_firmwarehuawei ar3200 firmwareeqv200r006c11
huawei:ar3200_firmwarehuawei ar3200 firmwareeqv200r008c00
huawei:ar3200_firmwarehuawei ar3200 firmwareeqv200r008c10

CPE	Name	Operator	Version
huawei:ar120-s_firmware	huawei ar120-s firmware	eq	v200r006c10
huawei:ar120-s_firmware	huawei ar120-s firmware	eq	v200r007c00
huawei:ar120-s_firmware	huawei ar120-s firmware	eq	v200r008c20
huawei:ar120-s_firmware	huawei ar120-s firmware	eq	v200r008c30
huawei:ar1200_firmware	huawei ar1200 firmware	eq	v200r007c01
huawei:ar1200_firmware	huawei ar1200 firmware	eq	v200r007c02
huawei:ar3200_firmware	huawei ar3200 firmware	eq	v200r006c11
huawei:ar3200_firmware	huawei ar3200 firmware	eq	v200r008c00
huawei:ar3200_firmware	huawei ar3200 firmware	eq	v200r008c10

CNA Affected

[
  {
    "product": "AR3200",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "V200R006C10,V200R006C11,V200R007C00,V200R007C01,V200R007C02,V200R008C00,V200R008C10,V200R008C20,V200R008C30"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20171129-02-sctp-en

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.2%

JSON

Related for CVE-2017-15344

nvd1 huawei1 cvelist1 prion1