HIGH
Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have an input validation vulnerability where the IPSec module does not validate a field in a specific message
Published Feb 17, 2020
7.5
HIGHCVSS 3.1
EPSS 0.74%
Description
Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have an input validation vulnerability where the IPSec module does not validate a field in a specific message. Attackers can send specific message to cause out-of-bound read, compromising normal service.
Affected products
-
- Version V500R001C30SPC200StatusaffectedConstraints-
- Version V500R001C30SPC600StatusaffectedConstraints-
- Version V500R001C60SPC500StatusaffectedConstraints-
- Version V500R005C00StatusaffectedConstraints-
- Version
-
- Version V500R001C30StatusaffectedConstraints-
- Version V500R001C30SPC200StatusaffectedConstraints-
- Version V500R001C30SPC600StatusaffectedConstraints-
- Version V500R001C60SPC500StatusaffectedConstraints-
- Version V500R005C00StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Huawei | Secospace USG6600 | n/a |
| ||||||||||||||||||
| Huawei | n/a | n/a |
|
Configuration 1
AND
OR
- v500r001c30
- v500r001c60spc500
- v500r005c00
Configuration 2
AND
OR
- v500r001c30spc200
- v500r001c30spc600
- v500r001c60spc500
- v500r005c00
Running on/with
- n/a
Configuration 3
AND
OR
- v500r001c30spc200
- v500r001c30spc600
- v500r001c60spc500
- v500r005c00
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (2)
References (2)
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-01-ipsec-en x_refsource_CONFIRMVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-12654 Advisory
| Link | Providers | Tags |
|---|---|---|
| http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-01-ipsec-en | x_refsource_CONFIRMVendor Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-12654 | Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner huawei
Published Feb 17, 2020
Updated Aug 4, 2024
Reserved Nov 29, 2019
Link CVE-2020-1828
CISA Vulnrichment
Updated n/a
ENISA EUVD
EUVD-2020-12654 Assigner huawei
Published Feb 17, 2020
Updated Aug 4, 2024
Exploited since n/a
Link EUVD-2020-12654