PT-2015-7725 · Huawei · Ne80E+5

Published 2015-10-21 · Updated 2015-11-20 · CVE-2015-8087

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Huawei NE20E-S, NE40E-M, and NE40E-M2 routers with software before V800R007C10SPC100 Huawei NE40E and NE80E routers with software before V800R007C00SPC100

Description A VPN routing and forwarding (VRF) hopping issue exists, allowing remote attackers to send crafted MPLS forwarding packets to other VPNs, potentially leading to flooding attacks. This occurs because the routers do not strictly check received MPLS forwarding packets, enabling an attacker to forward crafted packets to MPLS links and conduct flood attacks against the destination VPN.

Recommendations For Huawei NE20E-S, NE40E-M, and NE40E-M2 routers with software before V800R007C10SPC100, update to V800R007C10SPC100 or later. For Huawei NE40E and NE80E routers with software before V800R007C00SPC100, update to V800R007C00SPC100 or later.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2015-8087

Affected Products

Huawei Vrp

Ne20E-S

Ne40E

Ne40E-M

Ne40E-M2

Ne80E

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-8087 · Security Note
• http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-457933.htm · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8087 · Security Note
• https://huawei.com/en/psirt/security-advisories/hw-457933 · Note