PT-2018-6438 · Huawei · Te50+5

Published 2018-02-15 · Updated 2018-02-26 · CVE-2017-17186

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Huawei DP300 versions V500R002C00 Huawei RP200 versions V500R002C00, V600R006C00 Huawei TE30 versions V100R001C10, V500R002C00, V600R006C00 Huawei TE40 versions V500R002C00, V600R006C00 Huawei TE50 versions V500R002C00, V600R006C00 Huawei TE60 versions V100R001C10, V500R002C00, V600R006C00

Description: The issue is caused by insufficient input validation, allowing an authenticated, remote attacker to send malformed SOAP packets to the target device. This could result in data being overwritten, device memory being leaked, and potentially a process being reset.

Recommendations: For Huawei DP300 version V500R002C00, update the software to a version that includes input validation for SOAP packets. For Huawei RP200 versions V500R002C00, V600R006C00, restrict access to the SOAP interface until a patch is available. For Huawei TE30 versions V100R001C10, V500R002C00, V600R006C00, consider disabling the SOAP service temporarily to prevent exploitation. For Huawei TE40 versions V500R002C00, V600R006C00, apply configuration changes to limit the impact of malformed SOAP packets. For Huawei TE50 versions V500R002C00, V600R006C00, avoid using the vulnerable SOAP interface until the issue is resolved. For Huawei TE60 versions V100R001C10, V500R002C00, V600R006C00, as a temporary workaround, consider implementing additional validation for incoming SOAP packets.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-17186

Affected Products

Dp300

Rp200

Te30

Te40

Te50

Te60

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-17186 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17186 · Vendor Advisory
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20180207-01-soap-en · Vendor Advisory