PT-2018-6416 · Huawei · Huawei Dp300

Publicado 2018-03-09 · Atualizado 2018-03-29 · CVE-2017-17148

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Huawei DP300 version V500R002C00

Description: The issue is due to the lack of validation when the malloc function is called, allowing an authenticated local attacker to craft specific XML files that, when parsed, can result in denial-of-service (DoS) attacks.

Recommendations: For Huawei DP300 version V500R002C00, consider restricting access to the XML file parsing functionality until a patch is available. As a temporary workaround, limit the ability of local attackers to craft and parse malicious XML files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-17148

Produtos afetados

Huawei Dp300

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-17148 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-17148 · Aviso do Fabricante
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20171215-01-xml-en · Aviso do Fabricante