cnvd - cnvd-2021-01059

CNVD-2021-01059

Vulnerability from cnvd - Published: 2021-01-07

Title

Huawei 4G Router B612空指针解引用漏洞

Description

Huawei 4G Router B612是中国华为（Huawei）公司的一个LTE路由器产品。该产品可以使用4G网络做共享热点。 Huawei 4G Router B612存在安全漏洞。该漏洞源于程序未对输入进行正确验证。未经身份认证的攻击者可通过向受影响设备发送特制的UPNP消息利用该漏洞导致服务异常。

Severity

中

Patch Name

Huawei 4G Router B612空指针解引用漏洞的补丁

Patch Description

Huawei 4G Router B612是中国华为（Huawei）公司的一个LTE路由器产品。该产品可以使用4G网络做共享热点。 Huawei 4G Router B612存在安全漏洞。该漏洞源于程序未对输入进行正确验证。未经身份认证的攻击者可通过向受影响设备发送特制的UPNP消息利用该漏洞导致服务异常。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200826-01-pointer_en

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-9086

Impacted products

Name
['Huawei Huawei 4G Router B612 B612s-25dTCPU-V100R001B192D03SP00C287', 'Huawei Huawei 4G Router B612 B612s-25dTCPU-V100R001B192D05SP00C00', 'Huawei HUAWEI 4G Router B612 B612s-25dTCPU-V100R001B192D03SP00C234']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-9086",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-9086"
    }
  },
  "description": "Huawei 4G Router B612\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u4e00\u4e2aLTE\u8def\u7531\u5668\u4ea7\u54c1\u3002\u8be5\u4ea7\u54c1\u53ef\u4ee5\u4f7f\u75284G\u7f51\u7edc\u505a\u5171\u4eab\u70ed\u70b9\u3002\n\nHuawei 4G Router B612\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u5bf9\u8f93\u5165\u8fdb\u884c\u6b63\u786e\u9a8c\u8bc1\u3002\u672a\u7ecf\u8eab\u4efd\u8ba4\u8bc1\u7684\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5411\u53d7\u5f71\u54cd\u8bbe\u5907\u53d1\u9001\u7279\u5236\u7684UPNP\u6d88\u606f\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u670d\u52a1\u5f02\u5e38\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200826-01-pointer_en",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-01059",
  "openTime": "2021-01-07",
  "patchDescription": "Huawei 4G Router B612\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u4e00\u4e2aLTE\u8def\u7531\u5668\u4ea7\u54c1\u3002\u8be5\u4ea7\u54c1\u53ef\u4ee5\u4f7f\u75284G\u7f51\u7edc\u505a\u5171\u4eab\u70ed\u70b9\u3002\r\n\r\nHuawei 4G Router B612\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u5bf9\u8f93\u5165\u8fdb\u884c\u6b63\u786e\u9a8c\u8bc1\u3002\u672a\u7ecf\u8eab\u4efd\u8ba4\u8bc1\u7684\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5411\u53d7\u5f71\u54cd\u8bbe\u5907\u53d1\u9001\u7279\u5236\u7684UPNP\u6d88\u606f\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u670d\u52a1\u5f02\u5e38\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Huawei 4G Router B612\u7a7a\u6307\u9488\u89e3\u5f15\u7528\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Huawei Huawei 4G Router B612 B612s-25dTCPU-V100R001B192D03SP00C287",
      "Huawei Huawei 4G Router B612 B612s-25dTCPU-V100R001B192D05SP00C00",
      "Huawei HUAWEI 4G Router B612 B612s-25dTCPU-V100R001B192D03SP00C234"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-9086",
  "serverity": "\u4e2d",
  "submitTime": "2020-12-14",
  "title": "Huawei 4G Router B612\u7a7a\u6307\u9488\u89e3\u5f15\u7528\u6f0f\u6d1e"
}

CVE-2020-9086 (GCVE-0-2020-9086)

Vulnerability from cvelistv5 – Published: 2024-12-27 09:40 – Updated: 2024-12-27 15:06

Summary

There is a buffer error vulnerability in some Huawei product. An unauthenticated attacker may send special UPNP message to the affected products. Due to insufficient input validation of some value, successful exploit may cause some service abnormal. (Vulnerability ID: HWPSIRT-2017-08234) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9086.

Severity ?

4.3 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-124 - Buffer Underwrite ('Buffer Underflow')

Assigner

huawei

References

URL

Tags

https://www.huawei.com/en/psirt/security-advisori…

Impacted products

	Vendor	Product	Version
	Huawei	HUAWEI 4G Router B612	Affected: B612s-25dTCPU-V100R001B192D03SP00C234 Affected: B612s-25dTCPU-V100R001B192D03SP00C287 Affected: B612s-25dTCPU-V100R001B192D05SP00C00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-9086",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-27T15:06:44.647462Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-27T15:06:52.987Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "HUAWEI 4G Router B612",
          "vendor": "Huawei",
          "versions": [
            {
              "status": "affected",
              "version": "B612s-25dTCPU-V100R001B192D03SP00C234"
            },
            {
              "status": "affected",
              "version": "B612s-25dTCPU-V100R001B192D03SP00C287"
            },
            {
              "status": "affected",
              "version": "B612s-25dTCPU-V100R001B192D05SP00C00"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThere is a buffer error vulnerability in some Huawei product. An unauthenticated attacker may send special UPNP message to the affected products. Due to insufficient input validation of some value, successful exploit may cause some service abnormal. (Vulnerability ID: HWPSIRT-2017-08234)\u003c/p\u003e\u003cp\u003eThis vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9086.\u003c/p\u003e"
            }
          ],
          "value": "There is a buffer error vulnerability in some Huawei product. An unauthenticated attacker may send special UPNP message to the affected products. Due to insufficient input validation of some value, successful exploit may cause some service abnormal. (Vulnerability ID: HWPSIRT-2017-08234)\n\nThis vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2020-9086."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-124",
              "description": "CWE-124 Buffer Underwrite (\u0027Buffer Underflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-27T09:40:03.261Z",
        "orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
        "shortName": "huawei"
      },
      "references": [
        {
          "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200826-01-buffer_en"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
    "assignerShortName": "huawei",
    "cveId": "CVE-2020-9086",
    "datePublished": "2024-12-27T09:40:03.261Z",
    "dateReserved": "2020-02-18T00:00:00.000Z",
    "dateUpdated": "2024-12-27T15:06:52.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-01059

CVE-2020-9086 (GCVE-0-2020-9086)

Tags

Sightings

Nomenclature