CVE-2016-6901

CWE-20 — Improper Input Validation3 documents3 sources

Severity

6.5MEDIUM

EPSS

0.2%

top 53.89%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Huawei AR Firmware Huawei Netengine 16ex Firmware

Timeline

PublishedSep 26

Latest updateMay 17

Description

Format string vulnerability in Huawei AR100, AR120, AR150, AR200, AR500, AR550, AR1200, AR2200, AR2500, AR3200, and AR3600 routers with software before V200R007C00SPC900 and NetEngine 16EX routers with software before V200R007C00SPC900 allows remote authenticated users to cause a denial of service via format string specifiers in vectors involving partial commands.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDhuawei/netengine_16ex_firmwarev200r005, v200r006, v200r007c00+2

▶NVDhuawei/ar_firmwarev200r005, v200r006, v200r007c00+2

🔴Vulnerability Details

GHSA

GHSA-rfhj-2h7w-cr8x: Format string vulnerability in Huawei AR100, AR120, AR150, AR200, AR500, AR550, AR1200, AR2200, AR2500, AR3200, and AR3600 routers with software befor↗2022-05-17

▶

CVEList

CVE-2016-6901: Format string vulnerability in Huawei AR100, AR120, AR150, AR200, AR500, AR550, AR1200, AR2200, AR2500, AR3200, and AR3600 routers with software befor↗2016-09-26

▶