Lucene search

HuaweiCVE-2017-8200

HistoryNov 22, 2017 - 7:29 p.m.

CVE-2017-8200

2017-11-2219:29:05

CWE-125

huawei

web.nvd.nist.gov

cve-2017-8200

out-of-bounds read

h323 protocol

max presence

tp3106

tp3206

security vulnerability

exploit

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

34.4%

JSON

MAX PRESENCE V100R001C00, TP3106 V100R002C00, TP3206 V100R002C00 have an out-of-bounds read vulnerability in H323 protocol. An attacker logs in to the system as a user and send crafted packets to the affected products. Due to insufficient verification of the packets, successful exploit will cause process reboot.

Affected configurations

Nvd

Vulners

Node

huaweimax_presence_firmwareMatchv100r001c00

AND

huaweimax_presenceMatch-

Node

huaweitp3106_firmwareMatchv100r002c00

AND

huaweitp3106Match-

Node

huaweitp3206_firmwareMatchv100r002c00

AND

huaweitp3206Match-

VendorProductVersionCPE
huaweimax_presence_firmwarev100r001c00cpe:2.3:o:huawei:max_presence_firmware:v100r001c00:*:*:*:*:*:*:*
huaweimax_presence-cpe:2.3:h:huawei:max_presence:-:*:*:*:*:*:*:*
huaweitp3106_firmwarev100r002c00cpe:2.3:o:huawei:tp3106_firmware:v100r002c00:*:*:*:*:*:*:*
huaweitp3106-cpe:2.3:h:huawei:tp3106:-:*:*:*:*:*:*:*
huaweitp3206_firmwarev100r002c00cpe:2.3:o:huawei:tp3206_firmware:v100r002c00:*:*:*:*:*:*:*
huaweitp3206-cpe:2.3:h:huawei:tp3206:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	max_presence_firmware	v100r001c00	cpe:2.3:o:huawei:max_presence_firmware:v100r001c00:::::::*
huawei	max_presence	-	cpe:2.3:h:huawei:max_presence:-:::::::*
huawei	tp3106_firmware	v100r002c00	cpe:2.3:o:huawei:tp3106_firmware:v100r002c00:::::::*
huawei	tp3106	-	cpe:2.3:h:huawei:tp3106:-:::::::*
huawei	tp3206_firmware	v100r002c00	cpe:2.3:o:huawei:tp3206_firmware:v100r002c00:::::::*
huawei	tp3206	-	cpe:2.3:h:huawei:tp3206:-:::::::*

CNA Affected

[
  {
    "product": "MAX PRESENCE,TP3106,TP3206",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "V100R001C00,V100R002C00,V100R002C00"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20170927-01-h323-en

www.securityfocus.com/bid/101948

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

34.4%

JSON

Related for CVE-2017-8200