VulnerabilityModified

CVE-2020-9067

There is a buffer overflow vulnerability in some Huawei products.

HIGH 8.0EPSS 0.62%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.62%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

There is a buffer overflow vulnerability in some Huawei products. The vulnerability can be exploited by an attacker to perform remote code execution on the affected products when the affected product functions as an optical line terminal (OLT). Affected product versions include:SmartAX MA5600T versions V800R013C10, V800R015C00, V800R015C10, V800R017C00, V800R017C10, V800R018C00, V800R018C10; SmartAX MA5800 versions V100R017C00, V100R017C10, V100R018C00, V100R018C10, V100R019C10; SmartAX EA5800 versions V100R018C00, V100R018C10, V100R019C10.

CVSS 3.1: 8.0 HIGHCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.62% probability · 48th percentile
CISA KEV: Not listed
Weakness: CWE-120
Affected: huawei/smartax ma5600t firmware · huawei/smartax ma5800 firmware · huawei/smartax ea5800 firmware
Source: psirt@huawei.com

References

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200401-01-overflow-enVendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200401-01-overflow-enVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.