VulnerabilityModified

CVE-2020-9200

There has a CSV injection vulnerability in iManager NetEco 6000 versions V600R021C00.

HIGH 7.8EPSS 0.31%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.31%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

There has a CSV injection vulnerability in iManager NetEco 6000 versions V600R021C00. An attacker with common privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files to the target device.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.31% probability · 24th percentile
CISA KEV: Not listed
Weakness: CWE-1236
Affected: huawei/imanager neteco 6000
Source: psirt@huawei.com

References

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201209-01-csvinjection-enVendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201209-01-csvinjection-enVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.