PT-2019-4453 · Huawei · Huawei Cloudlink Phone 7900

Alexander Traud · Publicado 2019-07-24 · Atualizado 2019-08-27 · CVE-2019-5280

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions Huawei CloudLink Phone 7900 version V600R019C10

Description The issue concerns a TLS certificate verification vulnerability in the SIP TLS module. Due to insufficient verification of specific parameters of the TLS server certificate, attackers can perform man-in-the-middle attacks. This can lead to affected phones being registered abnormally, affecting the availability of IP phones. The vulnerability can be exploited by a remote attacker to perform such attacks.

Recommendations For Huawei CloudLink Phone 7900 version V600R019C10, consider disabling the SIP TLS module until a patch is available to prevent man-in-the-middle attacks. Restrict access to the phone's registration process to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

BDU:2020-00240

CVE-2019-5280

Produtos afetados

Huawei Cloudlink Phone 7900

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-5280 · Nota de Segurança
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20190724-01-7900-en · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2020-00240 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-5280 · Aviso do Fabricante