Medium severity · published Nov 22, 2017
CVE-2017-8162
AR120-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR1200 with software V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20,…
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
AR120-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR1200 with software V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30,AR1200-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR150 with software V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30,AR150-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR160 with software V200R006C10, V200R006C12, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30,AR200 with software V200R006C10, V200R007C00, V200R007C01, V200R008C20, V200R008C30,AR200-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR2200 with software V200R006C10, V200R006C13, V200R006C16PWE, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30,AR2200-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR3200 with software V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20, V200R008C30,AR510 with software V200R006C10, V200R006C12, V200R006C13, V200R006C15, V200R006C16, V200R006C17, V200R007C00, V200R008C20, V200R008C30,NetEngine16EX with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,SMC2.0 with software V100R003C10, V100R005C00, V500R002C00, V600R006C00,SRG1300 with software V200R006C10, V200R007C00, V200R007C02, V200R008C20, V200R008C30,SRG2300 with software V200R006C10, V200R007C00, V200R007C02, V200R008C20, V200R008C30,SRG3300 with software V200R006C10, V200R007C00, V200R008C20, V200R008C30 have a DoS vulnerability. Due to incorrect malformed message processing logic, an authenticated, remote attacker could send specially crafted message to the target device.Successful exploit of the vulnerability could cause stack overflow and make a service unavailable.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Ar120-s Firmware · Huawei
v200r006c10; v200r007c00; v200r008c20; v200r008c30 · source: NVD
AF
Ar1200 Firmware · Huawei
v200r006c10; v200r006c13; v200r007c00; v200r007c01; v200r007c02; v200r008c20; +1 more · source: NVD
AF
Ar1200-s Firmware · Huawei
v200r006c10; v200r007c00; v200r008c20; v200r008c30 · source: NVD
AF
Ar150 Firmware · Huawei
v200r006c10; v200r007c00; v200r007c01; v200r007c02; v200r008c20; v200r008c30 · source: NVD
AF
Ar150-s Firmware · Huawei
v200r006c10; v200r007c00; v200r008c20; v200r008c30 · source: NVD
AF
Ar160 Firmware · Huawei
v200r006c10; v200r006c12; v200r007c00; v200r007c01; v200r007c02; v200r008c20; +1 more · source: NVD
AF
Ar200 Firmware · Huawei
v200r006c10; v200r007c00; v200r007c01; v200r008c20; v200r008c30 · source: NVD
AF
Ar200-s Firmware · Huawei
v200r006c10; v200r007c00; v200r008c20; v200r008c30 · source: NVD
AF
Ar2200 Firmware · Huawei
v200r006c10; v200r006c13; v200r006c16pwe; v200r007c00; v200r007c01; v200r007c02; +2 more · source: NVD
AF
Ar2200-s Firmware · Huawei
v200r006c10; v200r007c00; v200r008c20; v200r008c30 · source: NVD
AF
Ar3200 Firmware · Huawei
v200r006c10; v200r006c11; v200r007c00; v200r007c01; v200r007c02; v200r008c00; +3 more · source: NVD
AF
Ar510 Firmware · Huawei
v200r006c10; v200r006c12; v200r006c13; v200r006c15; v200r006c16; v200r006c17; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-8162
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-8162
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171018-01-h323-en
More from Ar120-s Firmware
9.8
CVE-2017-17301
Huawei AR120-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, AR1200 V200R005C20, V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, AR1200-S…
7.5
CVE-2019-19417
The SIP module of some Huawei products have a denial of service (DoS) vulnerability
7.5
CVE-2019-19416
The SIP module of some Huawei products have a denial of service (DoS) vulnerability
7.5
CVE-2019-19415
The SIP module of some Huawei products have a denial of service (DoS) vulnerability
7.5
CVE-2019-5304
Some Huawei products have a buffer error vulnerability