PT-2019-4453 · Huawei · Huawei Cloudlink Phone 7900

Alexander Traud · Published 2019-07-24 · Updated 2019-08-27 · CVE-2019-5280

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions Huawei CloudLink Phone 7900 version V600R019C10

Description The issue concerns a TLS certificate verification vulnerability in the SIP TLS module. Due to insufficient verification of specific parameters of the TLS server certificate, attackers can perform man-in-the-middle attacks. This can lead to affected phones being registered abnormally, affecting the availability of IP phones. The vulnerability can be exploited by a remote attacker to perform such attacks.

Recommendations For Huawei CloudLink Phone 7900 version V600R019C10, consider disabling the SIP TLS module until a patch is available to prevent man-in-the-middle attacks. Restrict access to the phone's registration process to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2020-00240

CVE-2019-5280

Affected Products

Huawei Cloudlink Phone 7900

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-5280 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20190724-01-7900-en · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00240 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5280 · Vendor Advisory