CVE-2019-5268: Some Huawei home routers have an input validation vulnerability. Due to input parameter is not correctly verified, an attacker can exploit this vulnerability…

PriorityP341high8.1CVSS 3.1

AVAACLPRNUINSUCHIHAN

EPSS

0.38%

30.5th percentile

Some Huawei home routers have an input validation vulnerability. Due to input parameter is not correctly verified, an attacker can exploit this vulnerability by sending special constructed packets to obtain files in the device and upload files to some directories.

Affected

23 ranges

Vendor	Product	Version range	Fixed in
huawei	cd10-10_firmware	>= 10.0.2.2 < 10.0.2.7	10.0.2.7
huawei	cd16-10_firmware	>= 10.0.2.3 < 10.0.2.5	10.0.2.5
huawei	cd17-10_firmware	>= 9.0.3.3 < 10.0.2.5	10.0.2.5
huawei	cd18-10_firmware	>= 9.0.2.23 < 10.0.2.5	10.0.2.5
huawei	hirouter-cd15-10_firmware	>= 9.0.2.3 < 10.0.2.5	10.0.2.5
huawei	hirouter-cd20-10_firmware	>= 9.0.3.9 < 10.0.2.6	10.0.2.6
huawei	hirouter-cd21-16_firmware	>= 9.0.3.9 < 10.0.2.5	10.0.2.5
huawei	hirouter-cd30-10_firmware	>= 10.0.2.8 < 10.0.2.9	10.0.2.9
huawei	hirouter-cd30-11_firmware	>= 10.0.2.8 < 10.0.2.9	10.0.2.9
huawei	hirouter-h1-10_firmware	>= 9.0.3.11 < 10.0.2.5	10.0.2.5
huawei	tc5200-10_firmware	>= 10.0.2.3 < 10.0.2.5	10.0.2.5
huawei	ws5100-10_firmware	>= 9.0.3.11 < 10.0.2.7	10.0.2.7
huawei	ws5102-10_firmware	>= 10.0.2.2 < 10.0.2.7	10.0.2.7
huawei	ws5106-10_firmware	>= 10.0.2.2 < 10.0.2.7	10.0.2.7
huawei	ws5108-10_firmware	>= 10.0.2.2 < 10.0.2.7	10.0.2.7
huawei	ws5200-10_firmware	>= 9.0.3.9 < 10.0.2.6	10.0.2.6
huawei	ws5200-11_firmware	—	—
huawei	ws5200-11_firmware	—	—
huawei	ws5280-10_firmware	>= 9.0.3.22 < 10.0.2.6	10.0.2.6
huawei	ws5280-11_firmware	>= 9.0.3.22 < 10.0.2.6	10.0.2.6
huawei	ws6500-10_firmware	>= 10.0.2.3 < 10.0.2.5	10.0.2.5
huawei	ws6500-11_firmware	>= 10.0.2.2 < 10.0.2.7	10.0.2.7
huawei	ws826-10_firmware	>= 9.0.3.11 < 10.0.2.5	10.0.2.5

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

nvdv2.04.8MEDIUMAV:A/AC:L/Au:N/C:P/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.