High severity · published Apr 19, 2018
CVE-2018-7920
Huawei AR1200 V200R006C10SPC300, AR160 V200R006C10SPC300, AR200 V200R006C10SPC300, AR2200 V200R006C10SPC300, AR3200 V200R006C10SPC300 devices have an improper resource management…
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
Huawei AR1200 V200R006C10SPC300, AR160 V200R006C10SPC300, AR200 V200R006C10SPC300, AR2200 V200R006C10SPC300, AR3200 V200R006C10SPC300 devices have an improper resource management vulnerability. Due to the improper implementation of ACL mechanism, a remote attacker may send TCP messages to the management interface of the affected device to exploit this vulnerability. Successful exploit could exhaust the socket resource of management interface, leading to a DoS condition.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Ar1200 Firmware · Huawei
v200r006c10spc300 · source: NVD
AF
Ar160 Firmware · Huawei
v200r006c10spc300 · source: NVD
AF
Ar200 Firmware · Huawei
v200r006c10spc300 · source: NVD
AF
Ar2200 Firmware · Huawei
v200r006c10spc300 · source: NVD
AF
Ar3200 Firmware · Huawei
v200r006c10spc300 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7920
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7920
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180418-01-ar-en
More from Ar1200 Firmware
9.8
CVE-2017-17301
Huawei AR120-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, AR1200 V200R005C20, V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, AR1200-S…
7.5
CVE-2019-19417
The SIP module of some Huawei products have a denial of service (DoS) vulnerability
7.5
CVE-2019-19416
The SIP module of some Huawei products have a denial of service (DoS) vulnerability
7.5
CVE-2019-19415
The SIP module of some Huawei products have a denial of service (DoS) vulnerability
7.5
CVE-2019-5304
Some Huawei products have a buffer error vulnerability