CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2020-1828
https://notcve.org/view.php?id=CVE-2020-1828
Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have an input validation vulnerability where the IPSec module does not validate a field in a specific message. Attackers can send specific message to cause out-of-bound read, compromising normal service. Huawei NIP6800 versiones V500R001C30, V500R001C60SPC500 y V500R005C00; y Secospace USG6600 y USG9500 versiones V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500 y V500R005C00, presentan una vulnerabilidad de comprobación de entrada donde el módulo IPSec no comprueba un campo en un mensaje específico. Los atacantes pueden enviar mensajes específicos para causar una lectura fuera de límite, comprometiendo el servicio normal. • http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-01-ipsec-en • CWE-20: Improper Input Validation CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2020-1858
https://notcve.org/view.php?id=CVE-2020-1858
Huawei products NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; Secospace USG6600 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100; and USG9500 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100 have a denial of service vulnerability. Attackers need to perform a series of operations in a special scenario to exploit this vulnerability. Successful exploit may cause the new connections can't be established, result in a denial of service. Los Productos de Huawei NIP6800 versiones V500R001C30, V500R001C60SPC500 y V500R005C00SPC100; Secospace USG6600 versiones V500R001C30SPC600, V500R001C60SPC500 y V500R005C00SPC100; y USG9500 versiones V500R001C30SPC600, V500R001C60SPC500 y V500R005C00SPC100, presentan una vulnerabilidad de denegación de servicio. Los atacantes necesitan llevar a cabo una serie de operaciones en un escenario especial para explotar esta vulnerabilidad. • http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200205-01-dos-en http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200219-04-dos-en •
CVSS: 4.3EPSS: 3%CPEs: 7EXPL: 0CVE-2019-19411
https://notcve.org/view.php?id=CVE-2019-19411
USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 have an information leakage vulnerability. Due to improper processing of the initialization vector used in a specific encryption algorithm, an attacker who gains access to this cryptographic primitive may exploit this vulnerability to cause the value of the confidentiality associated with its use to be diminished. El dispositivo USG9500 de HUAWEI con versiones de V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200, presentan una vulnerabilidad de filtrado de información. Debido a un procesamiento inapropiado del vector de inicialización usado en un algoritmo de cifrado específico, un atacante que consigue acceso a esta primitiva criptográfica puede explotar esta vulnerabilidad para causar que el valor de la confidencialidad asociada con su uso sea disminuido. • https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-firewall-en • CWE-665: Improper Initialization •
CVSS: 8.2EPSS: 0%CPEs: 7EXPL: 0CVE-2020-1871
https://notcve.org/view.php?id=CVE-2020-1871
USG9500 with software of V500R001C30SPC100; V500R001C30SPC200; V500R001C30SPC600; V500R001C60SPC500; V500R005C00SPC100; V500R005C00SPC200 have an improper credentials management vulnerability. The software does not properly manage certain credentials. Successful exploit could cause information disclosure or damage, and impact the confidentiality or integrity. USG9500 con software de versiones V500R001C30SPC100; V500R001C30SPC200; V500R001C30SPC600; V500R001C60SPC500; V500R005C00SPC100; V500R005C00SPC200, tiene una vulnerabilidad de administración de credenciales inapropiada. El software no administra apropiadamente determinadas credenciales. • https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200102-01-credential-en •
CVSS: 8.8EPSS: 0%CPEs: 13EXPL: 0CVE-2014-9137
https://notcve.org/view.php?id=CVE-2014-9137
Huawei USG9500 with software V200R001C01SPC800 and earlier versions, V300R001C00; USG2100 with software V300R001C00SPC900 and earlier versions; USG2200 with software V300R001C00SPC900; USG5100 with software V300R001C00SPC900 could allow an unauthenticated, remote attacker to conduct a CSRF attack against the user of the web interface. Huawei USG9500 con software V200R001C01SPC800 y versiones anteriores, V300R001C00; USG2100 con software V300R001C00SPC900 y versiones anteriores; USG2200 con software V300R001C00SPC900; USG5100 con software V300R001C00SPC900 podrían permitir a un atacante remoto no autenticado, llevar a cabo un ataque de CSRF contra el usuario de la interfaz web. • http://www.huawei.com/en/psirt/security-advisories/hw-372186 • CWE-352: Cross-Site Request Forgery (CSRF) •