VulnerabilityModified

CVE-2019-5269

Some Huawei home routers have an improper authorization vulnerability.

HIGH 7.8EPSS 0.22%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.22%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Some Huawei home routers have an improper authorization vulnerability. Due to improper authorization of certain programs, an attacker can exploit this vulnerability to execute uploaded malicious files and escalate privilege.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.22% probability · 13th percentile
CISA KEV: Not listed
Affected: huawei/cd10-10 firmware · huawei/cd16-10 firmware · huawei/cd17-10 firmware · huawei/cd18-10 firmware · huawei/hirouter-cd15-10 firmware · huawei/hirouter-cd20-10 firmware · huawei/hirouter-cd21-16 firmware · huawei/hirouter-cd30-10 firmware · huawei/hirouter-cd30-11 firmware · huawei/hirouter-h1-10 firmware · huawei/tc5200-10 firmware · huawei/ws5100-10 firmware · huawei/ws5102-10 firmware · huawei/ws5106-10 firmware · huawei/ws5108-10 firmware · huawei/ws5200-10 firmware · huawei/ws5200-11 firmware · huawei/ws5280-10 firmware · huawei/ws5280-11 firmware · huawei/ws6500-10 firmware · +2 more
Source: psirt@huawei.com

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191113-01-homerouter-enVendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191113-01-homerouter-enVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.