PT-2016-7030 · Huawei · Usg2100+4

Published 2016-08-10 · Updated 2016-11-28 · CVE-2016-6669

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Huawei USG2100, USG2200, USG5100, and USG5500 versions prior to V300R001C10SPC600

Description The issue is related to a buffer overflow in the Authentication, Authorization and Accounting (AAA) module. A remote attacker can send crafted Enterprise Application Platform (EAP) packets through a Remote Authentication Dial In User Service (RADIUS) server to execute arbitrary code on the affected devices.

Recommendations For versions prior to V300R001C10SPC600, update to V300R001C10SPC600 or later to resolve the issue. As a temporary workaround, consider restricting access to the AAA module to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2016-6669

Affected Products

Huawei Vrp

Usg2100

Usg2200

Usg5100

Usg5500

References · 4

• https://osv.dev/vulnerability/CVE-2016-6669 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6669 · Security Note
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20160810-01-usg-en · Note
• http://securityfocus.com/bid/92441 · Note