PT-2020-15087 · Huawei · Secospace Usg9500+3

Published 2020-02-12 · Updated 2021-07-21 · CVE-2020-1814

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00 Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00

Description The issue is related to a dangling pointer dereference vulnerability. An authenticated attacker may perform specific operations in certain scenarios to exploit this vulnerability. Improper race conditions of different operations can lead to a dangling pointer dereference, causing service abnormalities.

Recommendations For Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00, update to a version that addresses the dangling pointer dereference issue. For Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00, update to a version that addresses the dangling pointer dereference issue. As a temporary workaround, consider restricting access to the affected products to minimize the risk of exploitation.

Fix

Race Condition

Buffer Overflow

Weakness Enumeration

CWE-362

CWE-119

Related Identifiers

CVE-2020-1814

Affected Products

Huawei Nip6800

Huawei Vrp

Secospace Usg6600

Secospace Usg9500

References · 3

• http://huawei.com/en/psirt/security-advisories/huawei-sa-20200212-01-firewall-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1814 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1814 · Vendor Advisory