VulnerabilityModified

CVE-2017-17166

MEDIUM 5.3EPSS 1.26%

Does this matter?

Lower severity and a low EPSS score (1.26%). Track it; it rarely justifies an emergency change on its own.

Description

Huawei DP300 V500R002C00, Secospace USG6300 V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6500 V500R001C00, V500R001C20, V500R001C30, V500R001C50, Secospace USG6600 V500R001C00, V500R001C20, V500R001C30, V500R001C50, TP3206 V100R002C00, VP9660 V500R002C00, V500R002C10 have a resource exhaustion vulnerability. The software does not process certain field of H.323 message properly, a remote unauthenticated attacker could send crafted H.323 message to the device, successful exploit could cause certain service unavailable since the stack memory is exhausted.

CVSS 3.0: 5.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS: 1.26% probability · 68th percentile
CISA KEV: Not listed
Weakness: CWE-400
Affected: huawei/dp300 firmware · huawei/secospace usg6300 firmware · huawei/secospace usg6500 firmware · huawei/secospace usg6600 firmware · huawei/tp3206 firmware · huawei/vp9660 firmware
Source: psirt@huawei.com

References

http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171213-02-h323-enVendor Advisory
http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171213-02-h323-enVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.