Lucene search

Huawei TechnologiesHUAWEI-SA-20180131-01-ESPACE

HistoryJan 31, 2018 - 12:00 a.m.

Security Advisory - Two Remote Code Execution Vulnerabilities in Huawei eSpace Product

2018-01-3100:00:00

Huawei Technologies

www.huawei.com

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

68.1%

JSON

There are two remote code execution vulnerabilities in import Signal Tone function and import Language Package function of Huawei eSpace product. An authenticated, remote attacker can craft and send the packets to the affected products after the Signal Tone or Language Package is uploaded. Due to insufficient verification of the packets, this could be exploited to execute arbitrary code. (Vulnerability ID: HWPSIRT-2017-11029 and HWPSIRT-2017-11030)

These vulnerabilities have been assigned Common Vulnerabilities and Exposures (CVE) IDs: CVE-2017-17221 and CVE-2017-17222.

Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180131-01-espace-en

Affected configurations

Vulners

Node

huaweiespace_7950_firmwareMatchv200r003c30

huaweiespace_8950_firmwareMatchv200r003c00

huaweiespace_8950_firmwareMatchv200r003c30

VendorProductVersionCPE
huaweiespace_7950_firmwarev200r003c30cpe:2.3:o:huawei:espace_7950_firmware:v200r003c30:*:*:*:*:*:*:*
huaweiespace_8950_firmwarev200r003c00cpe:2.3:o:huawei:espace_8950_firmware:v200r003c00:*:*:*:*:*:*:*
huaweiespace_8950_firmwarev200r003c30cpe:2.3:o:huawei:espace_8950_firmware:v200r003c30:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	espace_7950_firmware	v200r003c30	cpe:2.3:o:huawei:espace_7950_firmware:v200r003c30:::::::*
huawei	espace_8950_firmware	v200r003c00	cpe:2.3:o:huawei:espace_8950_firmware:v200r003c00:::::::*
huawei	espace_8950_firmware	v200r003c30	cpe:2.3:o:huawei:espace_8950_firmware:v200r003c30:::::::*

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

68.1%

JSON

Related for HUAWEI-SA-20180131-01-ESPACE