Medium severity · published Mar 9, 2018
CVE-2017-17250
Huawei AR120-S V200R005C32; AR1200 V200R005C32; AR1200-S V200R005C32; AR150 V200R005C32; AR150-S V200R005C32; AR160 V200R005C32; AR200 V200R005C32; AR200-S V200R005C32; AR2200-S…
6.5
CVSS
1%
EPSS
No
On KEV
Description
Huawei AR120-S V200R005C32; AR1200 V200R005C32; AR1200-S V200R005C32; AR150 V200R005C32; AR150-S V200R005C32; AR160 V200R005C32; AR200 V200R005C32; AR200-S V200R005C32; AR2200-S V200R005C32; AR3200 V200R005C32; V200R007C00; AR510 V200R005C32; NetEngine16EX V200R005C32; SRG1300 V200R005C32; SRG2300 V200R005C32; SRG3300 V200R005C32 have an out-of-bounds write vulnerability. When a user executes a query command after the device received an abnormal OSPF message, the software writes data past the end of the intended buffer due to the insufficient verification of the input data. An unauthenticated, remote attacker could exploit this vulnerability by sending abnormal OSPF messages to the device. A successful exploit could cause the system to crash.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Ar120-s Firmware · Huawei
v200r005c32 · source: NVD
AF
Ar1200 Firmware · Huawei
v200r005c32 · source: NVD
AF
Ar1200-s Firmware · Huawei
v200r005c32 · source: NVD
AF
Ar150 Firmware · Huawei
v200r005c32 · source: NVD
AF
Ar150-s Firmware · Huawei
v200r005c32 · source: NVD
AF
Ar160 Firmware · Huawei
v200r005c32 · source: NVD
AF
Ar200 Firmware · Huawei
v200r005c32 · source: NVD
AF
Ar200-s Firmware · Huawei
v200r005c32 · source: NVD
AF
Ar2200-s Firmware · Huawei
v200r005c32 · source: NVD
AF
Ar3200 Firmware · Huawei
v200r005c32; v200r007c00 · source: NVD
AF
Ar510 Firmware · Huawei
v200r005c32 · source: NVD
NF
Netengine16ex Firmware · Huawei
v200r005c32 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-17250
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-17250
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180214-01-ospf-en
More from Ar120-s Firmware
9.8
CVE-2017-17301
Huawei AR120-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, AR1200 V200R005C20, V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, AR1200-S…
7.5
CVE-2019-19417
The SIP module of some Huawei products have a denial of service (DoS) vulnerability
7.5
CVE-2019-19416
The SIP module of some Huawei products have a denial of service (DoS) vulnerability
7.5
CVE-2019-19415
The SIP module of some Huawei products have a denial of service (DoS) vulnerability
7.5
CVE-2019-5304
Some Huawei products have a buffer error vulnerability