PT-2020-20476 · Huawei · Huawei Secospace Usg6300+1

Zhangrixin · Published 2020-06-10 · Updated 2021-07-21 · CVE-2020-9075

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Huawei Secospace USG6300;USG6300E versions V500R001C30 through V500R001C80 Huawei Secospace USG6300;USG6300E versions V500R005C00 through V500R005C10 Huawei Secospace USG6300;USG6300E version V600R006C00

Description The issue is related to insufficient input verification, allowing an attacker with limited privilege to access a specific directory. This could lead to information leakage.

Recommendations For versions V500R001C30 through V500R001C80, update to a version that includes the necessary security patches to fix the insufficient input verification issue. For versions V500R005C00 through V500R005C10, apply the recommended configuration changes to restrict access to the specific directory that can be exploited. For version V600R006C00, consider temporarily restricting access to the directory until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-9075

Affected Products

Huawei Secospace Usg6300

Huawei Vrp

References · 3

• https://huawei.com/en/psirt/security-advisories/huawei-sa-20200610-02-validation-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9075 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9075 · Security Note