PT-2020-15088 · Huawei · Secospace Usg9500+3

Published 2020-02-12 · Updated 2021-07-21 · CVE-2020-1815

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00 Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00

Description The software has a memory leak issue due to insufficient tracking and release of allocated memory while parsing certain messages. An attacker can exploit this by continuously sending these messages, potentially consuming all remaining memory and causing memory exhaustion.

Recommendations For Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00, update to a version that includes the fix for the memory leak issue. For Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00, update to a version that includes the fix for the memory leak issue. As a temporary workaround, consider restricting the parsing of certain messages to minimize the risk of exploitation.

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2020-1815

Affected Products

Huawei Nip6800

Huawei Vrp

Secospace Usg6600

Secospace Usg9500

References · 3

• https://osv.dev/vulnerability/CVE-2020-1815 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1815 · Security Note
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20200212-02-firewall-en · Vendor Advisory