CVE-2017-15348

published 2018-02-15

CVE-2017-15348: Huawei IPS Module V500R001C00, NGFW Module V500R001C00, NIP6300 V500R001C00, NIP6600 V500R001C00, Secospace USG6300 V500R001C00, Secospace USG6500 V500R001C00…

Priority P3 41 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C N I N A H

Huawei IPS Module V500R001C00, NGFW Module V500R001C00, NIP6300 V500R001C00, NIP6600 V500R001C00, Secospace USG6300 V500R001C00, Secospace USG6500 V500R001C00, Secospace USG6600 V500R001C00, USG9500 V500R001C00 have an insufficient input validation vulnerability. An unauthenticated, remote attacker could send specific MPLS Echo Request messages to the target products. Due to insufficient input validation of some parameters in the messages, successful exploit may cause the device to reset.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
huawei	ips_module_firmware	—	—
huawei	ngfw_module_firmware	—	—
huawei	nip6300_firmware	—	—
huawei	nip6600_firmware	—	—
huawei	secospace_usg6300_firmware	—	—
huawei	secospace_usg6500_firmware	—	—
huawei	secospace_usg6600_firmware	—	—
huawei	usg9500_firmware	—	—

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd v2.0 7.8 HIGH AV:N/AC:L/Au:N/C:N/I:N/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20