CVE-2020-9127 - Some Huawei products have a command injection vulnerability

Back Back to CVE browser

MEDIUM

Some Huawei products have a command injection vulnerability

Published Nov 13, 2020

6.7

MEDIUM

CVSS 3.1

EPSS 0.39%

Description

Some Huawei products have a command injection vulnerability. Due to insufficient input validation, an attacker with high privilege may inject some malicious codes in some files of the affected products. Successful exploit may cause command injection.Affected product versions include:NIP6300 versions V500R001C30,V500R001C60;NIP6600 versions V500R001C30,V500R001C60;Secospace USG6300 versions V500R001C30,V500R001C60;Secospace USG6500 versions V500R001C30,V500R001C60;Secospace USG6600 versions V500R001C30,V500R001C60;USG9500 versions V500R001C30,V500R001C60.

Affected products

Vendor n/a Product NIP6300;NIP6600;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG9500 Default
n/a
- Version
  V500R001C30,V500R001C60
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

NIP6300;NIP6600;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG9500

n/a

Version	Status	Constraints
V500R001C30,V500R001C60	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-77

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29956
Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201111-02-injection-en
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29956		Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201111-02-injection-en		x_refsource_MISCVendor Advisory