PT-2020-2665 · Huawei · Secospace Antiddos8000+1

Published 2020-03-18 · Updated 2020-03-23 · CVE-2020-1864

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Secospace AntiDDoS8000 versions V500R001C00 through V500R005C00

Description The issue is related to improper authentication in some Huawei products, allowing a remote attacker to execute arbitrary commands by forging the peer device and sending specific packets to the affected device. This is due to the improper implementation of the authentication function.

Recommendations For Secospace AntiDDoS8000 versions V500R001C00 through V500R005C00, consider disabling the authentication function temporarily until a patch is available. Restrict access to the affected devices to minimize the risk of exploitation. Avoid using the vulnerable authentication mechanism in the affected product versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2020-02709

CVE-2020-1864

Affected Products

Huawei Vrp

Secospace Antiddos8000

References · 5

• https://osv.dev/vulnerability/CVE-2020-1864 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02709 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20200318-01-authentication-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1864 · Security Note
• https://t.me/cvenotify/1952 · Telegram Post