PT-2020-20518 · Huawei · Cloudengine 7800+4

Published 2020-12-02 · Updated 2020-12-28 · CVE-2020-9137

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CloudEngine 12800 (affected versions not specified) CloudEngine 5800 (affected versions not specified) CloudEngine 6800 (affected versions not specified) CloudEngine 7800 (affected versions not specified)

Description The issue is related to a privilege escalation vulnerability due to insufficient input validation. A local attacker with high privilege may execute specially crafted scripts in the affected products, leading to privilege escalation.

Recommendations For CloudEngine 12800, update to a version that addresses the insufficient input validation issue. For CloudEngine 5800, update to a version that addresses the insufficient input validation issue. For CloudEngine 6800, update to a version that addresses the insufficient input validation issue. For CloudEngine 7800, update to a version that addresses the insufficient input validation issue. As a temporary workaround, consider restricting the execution of specially crafted scripts in the affected products until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-9137

Affected Products

Cloudengine 12800

Cloudengine 5800

Cloudengine 6800

Cloudengine 7800

Huawei Vrp

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-9137 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20201202-02-privilege-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9137 · Vendor Advisory
• https://t.me/cibsecurity/21277 · Telegram Post