CVSS: 6.5EPSS: 0%CPEs: 85EXPL: 0CVE-2020-9071
https://notcve.org/view.php?id=CVE-2020-9071
There is a few bytes out-of-bounds read vulnerability in some Huawei products. The software reads data past the end of the intended buffer when parsing certain message, an authenticated attacker could exploit this vulnerability by sending crafted messages to the device. Successful exploit may cause service abnormal in specific scenario.Affected product versions include:AR120-S versions V200R007C00SPC900,V200R007C00SPCa00 Se presenta una vulnerabilidad de lectura fuera de límites de ciertos bytes en algunos productos Huawei. El software lee los datos más allá del final del búfer previsto cuando se analiza determinado mensaje, un atacante autenticado podría explotar esta vulnerabilidad mediante el envío de mensajes diseñados al dispositivo. Un explotación con éxito puede causar un servicio anormal en un escenario específico. • https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-01-oob-en • CWE-125: Out-of-bounds Read •
CVSS: 5.9EPSS: 0%CPEs: 454EXPL: 0CVE-2017-17151
https://notcve.org/view.php?id=CVE-2017-17151
Huawei AR100, AR100-S, AR110-S, AR120, AR120-S, AR1200, AR1200-S, AR150, AR150-S, AR160, AR200, AR200-S, AR2200, AR2200-S, AR3200, AR510, DP300, NetEngine16EX, RP200, SRG1300, SRG2300, SRG3300, TE30, TE40, TE50, TE60, TP3106, TP3206, ViewPoint 8660, and ViewPoint 9030 have an insufficient validation vulnerability. Since packet validation is insufficient, an unauthenticated attacker may send special H323 packets to exploit the vulnerability. Successful exploit could allow the attacker to send malicious packets and result in DOS attacks. Huawei AR100, AR100-S, AR110-S, AR120, AR120-S, AR1200, AR1200-S, AR150, AR150-S, AR160, AR200, AR200-S, AR2200, AR2200-S, AR3200, AR510, DP300, NetEngine16EX, RP200, SRG1300, SRG2300, SRG3300, TE30, TE40, TE50, TE60, TP3106, TP3206, ViewPoint 8660 y ViewPoint 9030 tienen una vulnerabilidad de validación insuficiente. Debido a que la validación de paquetes es insuficiente, un atacante no autenticado podría enviar paquetes H323 especiales para explotar la vulnerabilidad. • http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-01-h323-en • CWE-20: Improper Input Validation •