PT-2018-6416 · Huawei · Huawei Dp300

Published 2018-03-09 · Updated 2018-03-29 · CVE-2017-17148

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Huawei DP300 version V500R002C00

Description: The issue is due to the lack of validation when the malloc function is called, allowing an authenticated local attacker to craft specific XML files that, when parsed, can result in denial-of-service (DoS) attacks.

Recommendations: For Huawei DP300 version V500R002C00, consider restricting access to the XML file parsing functionality until a patch is available. As a temporary workaround, limit the ability of local attackers to craft and parse malicious XML files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-17148

Affected Products

Huawei Dp300

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-17148 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17148 · Vendor Advisory
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20171215-01-xml-en · Vendor Advisory