PT-2020-1839 · Huawei · Nip6300+6

Published 2020-02-05 · Updated 2021-07-21 · CVE-2020-1856

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Huawei NGFW Module, NIP6300, NIP6600, Secospace USG6500, Secospace USG6600, and USG9500 versions V500R001C30, V500R001C60, and V500R005C00

Description The issue is related to an information leakage vulnerability. It can be exploited by sending specific request packets to affected devices, potentially leading to information leakage. The vulnerability exists due to insufficient input validation, allowing a remote attacker to gain unauthorized access to protected information.

Recommendations For versions V500R001C30, V500R001C60, and V500R005C00, consider restricting access to the affected devices until a patch is available. As a temporary workaround, avoid using the vulnerable module in the affected Huawei products until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2020-01113

CVE-2020-1856

Affected Products

Huawei Ngfw Module

Huawei Vrp

Nip6300

Nip6600

Secospace Usg6500

Secospace Usg6600

Usg9500

References · 5

• https://bdu.fstec.ru/vul/2020-01113 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-1856 · Security Note
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20200205-01-firewall-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1856 · Vendor Advisory
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20200205-01-firewall-en · Note