VulnerabilityModified

CVE-2017-15344

Huawei AR3200 with software V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20, V200R008C30 has an integer overflow vulnerability.

HIGH 7.5EPSS 1.35%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.35%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Huawei AR3200 with software V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20, V200R008C30 has an integer overflow vulnerability. The software does not sufficiently validate certain field in SCTP messages, a remote unauthenticated attacker could send a crafted SCTP message to the device. Successful exploit could cause system reboot.

CVSS 3.0: 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 1.35% probability · 70th percentile
CISA KEV: Not listed
Weakness: CWE-190
Affected: huawei/ar120-s firmware · huawei/ar1200 firmware · huawei/ar3200 firmware
Source: psirt@huawei.com

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171129-02-sctp-enVendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171129-02-sctp-enVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.