MEDIUM
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have a buffer overflow vulnerability
Published Dec 13, 2019
5.5
MEDIUMCVSS 3.1
EPSS 0.20%
Description
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have a buffer overflow vulnerability. An attacker who logs in to the board may send crafted messages from the internal network port or tamper with inter-process message packets to exploit this vulnerability. Due to insufficient validation of the message, successful exploit may cause the affected board to be abnormal.
Affected products
No data.
Configuration 1
AND
OR
- v200r005c30
- v200r006c10
- v200r006c20
- v200r007c10
- v200r007c20
- v200r008c00
- v200r008c10
- v200r009c00
Configuration 2
AND
OR
- v500r001c00spc300
- v500r001c00spc500
- v500r001c00sph303
- v500r001c00sph508
- v500r001c20
- v500r001c20spc100
- v500r001c20spc100pwe
- v500r001c20spc200
- v500r001c20spc200b062
- v500r001c20spc200pwe
- v500r001c20spc300b078
- v500r001c20spc300pwe
- v500r001c30
- v500r001c30spc100
- v500r001c30spc100pwe
- v500r001c30spc200
- v500r001c30spc200pwe
- v500r001c30spc300
- v500r001c50
- v500r001c50pwe
- v500r001c80
- v500r005c00
Configuration 3
AND
OR
- v500r001c00spc300
- v500r001c00spc500
- v500r001c00spc500pwe
- v500r001c00sph303
- v500r001c00sph508
- v500r001c20
- v500r001c20spc100
- v500r001c20spc100pwe
- v500r001c20spc200
- v500r001c20spc200b062
- v500r001c20spc200pwe
- v500r001c20spc300b078
- v500r001c20spc300pwe
- v500r002c00
- v500r002c00spc100
- v500r002c00spc100pwe
- v500r002c00spc200
- v500r002c00spc200pwe
- v500r002c00spc300
- v500r002c10
- v500r002c10pwe
- v500r002c30
- v500r002c30pwe
- v500r005c00
Configuration 4
AND
OR
- v500r001c00spc300
- v500r001c00spc500
- v500r001c00sph303
- v500r001c00sph508
- v500r001c20
- v500r001c20spc100
- v500r001c20spc100pwe
- v500r001c20spc200
- v500r001c20spc200b062
- v500r001c20spc200pwe
- v500r001c20spc300b078
- v500r001c20spc300pwe
- v500r001c30
- v500r001c30spc100
- v500r001c30spc100pwe
- v500r001c30spc200
- v500r001c30spc200pwe
- v500r001c30spc300
- v500r001c50
- v500r001c50pwe
- v500r001c80
- v500r005c00
Configuration 5
AND
OR
- v500r001c00spc300
- v500r001c00spc500
- v500r001c00sph303
- v500r001c00sph508
- v500r001c20
- v500r001c20spc100
- v500r001c20spc100pwe
- v500r001c20spc200
- v500r001c20spc200b062
- v500r001c20spc200pwe
- v500r001c20spc300b078
- v500r001c30
- v500r001c30spc100
- v500r001c30spc100pwe
- v500r001c30spc200
- v500r001c30spc200pwe
- v500r001c30spc300
- v500r001c50
- v500r001c50pwe
- v500r001c80
- v500r005c00
Configuration 6
AND
OR
- v500r001c50
- v500r001c50pwe
- v500r001c80
- v500r005c00
Configuration 7
AND
- v200r005c03
Configuration 8
AND
- v200r003c00spc100
Configuration 9
AND
- v200r003c00spc100
Configuration 10
AND
- v200r003c00spc100
Configuration 11
AND
OR
- v500r002c20
- v500r002c30
- v500r005c00
Configuration 12
AND
OR
- v500r001c00
- v500r001c00spc200
- v500r001c00spc300
- v500r001c00spc500
- v500r001c00spc600
- v500r001c00spc700
- v500r001c00sph303
- v500r001c20spc200
- v500r001c20spc300
- v500r001c20spc500
- v500r001c20spc600
- v500r001c60spc100
- v500r001c60spc101
- v500r001c60spc200
- v500r001c60spc300
- v500r001c60spc500
- v500r001c60spc600
- v500r005c00
- v500r005c00spc100
Running on/with
- n/a
Configuration 13
AND
OR
- v100r001c20spc100
- v500r001c00spc300
- v500r001c00spc500
- v500r001c00spc500pwe
- v500r001c00sph303
- v500r001c00sph508
- v500r001c20
- v500r001c20spc100
- v500r001c20spc100pwe
- v500r001c20spc101
- v500r001c20spc200
- v500r001c20spc200b062
- v500r001c20spc200pwe
- v500r001c20spc300b078
- v500r001c20spc300pwe
- v500r001c30
- v500r001c30spc100
- v500r001c30spc100pwe
- v500r001c30spc200
- v500r001c30spc200pwe
- v500r001c30spc300
- v500r001c50
- v500r001c50pwe
- v500r001c80
- v500r001c80pwe
- v500r005c00
Running on/with
- n/a
Configuration 14
AND
OR
- v100r001c20spc100
- v500r001c00spc300
- v500r001c00spc500
- v500r001c00spc500pwe
- v500r001c00sph303
- v500r001c00sph508
- v500r001c20
- v500r001c20spc100
- v500r001c20spc100pwe
- v500r001c20spc101
- v500r001c20spc200
- v500r001c20spc200b062
- v500r001c20spc200pwe
- v500r001c20spc300b078
- v500r001c20spc300pwe
- v500r001c30
- v500r001c30spc100
- v500r001c30spc100pwe
- v500r001c30spc200
- v500r001c30spc200pwe
- v500r001c30spc300
- v500r001c50
- v500r001c50pwe
- v500r001c80
- v500r001c80pwe
- v500r005c00
Running on/with
- n/a
Configuration 15
AND
OR
- v100r001c00spc200
- v100r001c10spc200
- v100r001c10spc201
- v100r001c20spc100
- v100r001c20spc200
- v500r001c00
- v500r001c00spc050
- v500r001c00spc090
- v500r001c00spc300
- v500r001c00spc500
- v500r001c00spc500pwe
- v500r001c00sph303
- v500r001c20
- v500r001c20spc100
- v500r001c20spc100pwe
- v500r001c20spc101
- v500r001c20spc200
- v500r001c20spc200pwe
- v500r001c20spc300
- v500r001c20spc300b078
- v500r001c20spc300pwe
- v500r001c30
- v500r001c30spc100
- v500r001c30spc100pwe
- v500r001c30spc200
- v500r001c30spc200pwe
- v500r001c30spc300
- v500r001c30spc500
- v500r001c30spc600
- v500r001c30spc600pwe
- v500r001c30spc601
- v500r001c50
- v500r001c50pwe
- v500r001c50spc009
- v500r001c50spc100
- v500r001c50spc100pwe
- v500r001c50spc200
- v500r001c50spc200pwe
- v500r001c50spc300
- v500r001c60
- v500r001c60spc100
- v500r001c60spc100pwe
- v500r001c60spc200
- v500r001c60spc200pwe
- v500r001c60spc300
- v500r001c60spc500
- v500r001c80
- v500r001c80pwe
- v500r005c00
- v500r005c00spc100
- v500r005c00spc102
Running on/with
- n/a
Configuration 16
AND
OR
- v500r001c10
- v500r001c10spc100
- v500r001c10spc200
- v500r001c20
- v500r001c20spc100
- v500r001c20spc200
- v500r001c20spc300
- v500r001c20spc500
- v500r001c20spc600
- v500r003c00
- v500r003c00spc100
- v500r005c00
- v500r005c00spc100
Configuration 17
AND
- v200r003c50spc700
Running on/with
- n/a
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
5.5 MEDIUM NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
No CVSS v3.0 score for this CVE.
2.1 LOW NVD
AV:L/AC:L/Au:N/C:N/I:N/A:P
Access Vector Local
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
0.20% 0.00197
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.00197
Score over time
2021–2026- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
Percentile over time
- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
Table of values (9 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.20% (0.00197) | 8.54th | v5 (v2026.06.15) |
| Sep 20, 2026 | 0.20% (0.00197) | 9.82th | v5 (v2026.06.15) |
| Jul 20, 2024 | 0.04% (0.00044) | 12.95th | v3 (v2023.03.01) |
| May 25, 2024 | 0.04% (0.00044) | 12.27th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.04% (0.00044) | 10.26th | v3 (v2023.03.01) |
| Mar 6, 2023 | 0.89% (0.00885) | 27.89th | v2 (v2022.01.01) |
| Jan 6, 2022 | 1.84% (0.01840) | 47.32th | v1 |
| Jan 5, 2022 | 0.42% (0.00416) | 26.65th | v5 (v2026.06.15) |
| Apr 14, 2021 | 0.42% (0.00416) | 0.00th | v1 |
Weaknesses (1)
References (1)
- https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-ssp-en x_refsource_MISCVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191211-01-ssp-en | x_refsource_MISCVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner huawei
Published Dec 13, 2019
Updated Aug 4, 2024
Reserved Jan 4, 2019
Link CVE-2019-5258
CISA Vulnrichment
Updated n/a