VulnerabilityModified

CVE-2020-9201

There is an out-of-bounds read vulnerability in some versions of NIP6800, Secospace USG6600 and USG9500.

MEDIUM 6.5EPSS 0.32%

Does this matter?

Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own.

Description

There is an out-of-bounds read vulnerability in some versions of NIP6800, Secospace USG6600 and USG9500. The software reads data past the end of the intended buffer when parsing DHCP messages including crafted parameter. Successful exploit could cause certain service abnormal.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.32% probability · 25th percentile
CISA KEV: Not listed
Weakness: CWE-125
Affected: huawei/nip6800 firmware · huawei/secospace usg6600 firmware · huawei/usg9500 firmware
Source: psirt@huawei.com

References

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-04-eudemon-enVendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-04-eudemon-enVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.