PT-2017-14761 · Huawei · Huawei S12700+5
Published
2017-12-15
·
Updated
2019-10-03
·
CVE-2017-17300
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Huawei S12700 versions V200R008C00 through V200R009C00
Huawei S5700 versions V200R007C00 through V200R009C00
Huawei S6700 versions V200R008C00 through V200R009C00
Huawei S7700 versions V200R008C00 through V200R009C00
Huawei S9700 versions V200R008C00 through V200R009C00
Description
The issue is related to numeric errors. An unauthenticated, remote attacker may send specific TCP messages with keychain authentication option to the affected products. Due to the improper validation of the messages, it will cause numeric errors when handling the messages. Successful exploit will cause the affected products to reset.
Recommendations
For Huawei S12700 versions V200R008C00 through V200R009C00, consider disabling the keychain authentication option until a patch is available.
For Huawei S5700 versions V200R007C00 through V200R009C00, restrict access to the affected TCP messages to minimize the risk of exploitation.
For Huawei S6700 versions V200R008C00 through V200R009C00, avoid using the keychain authentication option in the affected products until the issue is resolved.
For Huawei S7700 versions V200R008C00 through V200R009C00, consider implementing configuration changes to properly validate the TCP messages.
For Huawei S9700 versions V200R008C00 through V200R009C00, apply the necessary configuration changes to prevent the numeric errors.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Huawei S12700
Huawei S5700
Huawei S6700
Huawei S7700
Huawei S9700
Huawei Vrp