CVE-2020-1870

Опубликовано: 29 мая 2020

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

There is a denial of service vulnerability in some Huawei products. Due to improper memory management, memory leakage may occur in some special cases. Attackers can perform a series of operations to exploit this vulnerability. Successful exploit may cause a denial of service. Affected product versions include: CloudEngine 12800 versions V200R019C00SPC800; CloudEngine 5800 versions V200R019C00SPC800; CloudEngine 6800 versions V200R005C20SPC800, V200R019C00SPC800; CloudEngine 7800 versions V200R019C00SPC800; NE40E versions V800R011C00SPC200, V800R011C00SPC300, V800R011C10SPC100; NE40E-F versions V800R011C00SPC200, V800R011C10SPC100; NE40E-M versions V800R011C00SPC200, V800R011C10SPC100.

Ссылки

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-dos-en
Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200527-01-dos-en
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:huawei:cloudengine_12800_firmware:v200r019c00:*:*:*:*:*:*:*

cpe:2.3:o:huawei:cloudengine_12800_firmware:v200r019c00spc600:*:*:*:*:*:*:*

cpe:2.3:o:huawei:cloudengine_12800_firmware:v200r019c00spc800:*:*:*:*:*:*:*

cpe:2.3:o:huawei:cloudengine_12800_firmware:v200r019c10:*:*:*:*:*:*:*

cpe:2.3:h:huawei:cloudengine_12800:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:huawei:cloudengine_6800_firmware:v200r019c00spc800:*:*:*:*:*:*:*

cpe:2.3:h:huawei:cloudengine_6800:-:*:*:*:*:*:*:*

EPSS

Процентиль: 40%

0.00182

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-772

Связанные уязвимости

GHSA-v2q9-m664-5f32

github

больше 3 лет назад

CloudEngine 12800 products with versions of V200R019C00, V200R019C10SPC800, V200R019C00SPC600, V200R019C10; and CloudEngine 6800 products with versions of V200R019C00SPC800 have a denial of service vulnerability. Due to improper memory management, memory leakage may occur in some special cases. Attackers can perform a series of operations to exploit this vulnerability. Successful exploit may cause a denial of service.

BDU:2021-02135