PT-2017-14755 · Huawei · Te50+26
Published
2017-12-13
·
Updated
2018-03-01
·
CVE-2017-17294
CVSS v3.1
3.3
Low
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Huawei AR120-S versions V200R006C10 through V200R008C30
Huawei AR1200 versions V200R006C10 through V200R008C30
Huawei AR1200-S versions V200R006C10 through V200R008C30
Huawei AR150 versions V200R006C10 through V200R008C30
Huawei AR150-S versions V200R006C10 through V200R008C30
Huawei AR160 versions V200R006C10 through V200R008C30
Huawei AR200 versions V200R006C10 through V200R008C30
Huawei AR200-S versions V200R006C10 through V200R008C30
Huawei AR2200 versions V200R006C10 through V200R008C30
Huawei AR2200-S versions V200R006C10 through V200R008C30
Huawei AR3200 versions V200R006C10 through V200R008C30
Huawei AR3600 versions V200R006C10 through V200R008C20
Huawei AR510 versions V200R006C10 through V200R008C30
Huawei DP300 version V500R002C00
Huawei MAX PRESENCE version V100R001C00
Huawei NetEngine16EX versions V200R006C10 through V200R008C30
Huawei RP200 versions V500R002C00 through V600R006C00
Huawei SRG1300 versions V200R006C10 through V200R008C30
Huawei SRG2300 versions V200R006C10 through V200R008C30
Huawei SRG3300 versions V200R006C10 through V200R008C30
Huawei TE30 versions V100R001C02 through V600R006C00
Huawei TE40 versions V500R002C00 through V600R006C00
Huawei TE50 version V500R002C00
Huawei TE60 versions V100R001C01 through V600R006C00
Huawei TP3106 version V100R002C00
Huawei TP3206 versions V100R002C00 through V100R002C10
Description
The issue is caused by insufficient input validation, allowing an authenticated, local attacker to craft a specific XML file and cause a null pointer dereference. Successful exploitation will result in some service abnormality.
Recommendations
For all affected versions, consider disabling the XML file processing functionality as a temporary workaround until a patch is available.
Restrict access to the affected products to minimize the risk of exploitation.
Avoid using the affected products until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ar120-S
Ar1200
Ar1200-S
Ar150
Ar150-S
Ar160
Ar200
Ar200-S
Ar2200
Ar2200-S
Ar3200
Ar3600
Ar510
Dp300
Huawei Vrp
Max Presence
Netengine16Ex
Rp200
Srg1300
Srg2300
Srg3300
Te30
Te40
Te50
Te60
Tp3106
Tp3206