PT-2020-15135 · Huawei · Usg9500+3

Published 2020-02-19 · Updated 2020-03-03 · CVE-2020-1877

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions NIP6800 versions V500R001C30 through V500R005C00SPC100 Secospace USG6600 versions V500R001C30 through V500R005C00SPC100 USG9500 versions V500R001C30 through V500R005C00SPC100

Description The software system accesses an invalid pointer when an administrator logs in to the device and performs some operations. Successful exploitation could cause certain process reboot.

Recommendations For NIP6800 versions V500R001C30 through V500R005C00SPC100, restrict access to administrative operations until a patch is available. For Secospace USG6600 versions V500R001C30 through V500R005C00SPC100, consider disabling the login functionality for administrators as a temporary workaround. For USG9500 versions V500R001C30 through V500R005C00SPC100, avoid performing critical operations after administrator login until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

CVE-2020-1877

Affected Products

Huawei Vrp

Nip6800

Secospace Usg6600

Usg9500

References · 4

• https://osv.dev/vulnerability/CVE-2020-1877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1877 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20200219-05-invalidpointer-en · Vendor Advisory
• https://t.me/cvenotify/1289 · Telegram Post