CVE-2019-5269

published 2019-11-29

CVE-2019-5269: Some Huawei home routers have an improper authorization vulnerability. Due to improper authorization of certain programs, an attacker can exploit this…

Priority P3 38 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

Some Huawei home routers have an improper authorization vulnerability. Due to improper authorization of certain programs, an attacker can exploit this vulnerability to execute uploaded malicious files and escalate privilege.

Affected

23 ranges

Vendor	Product	Version range	Fixed in
huawei	cd10-10_firmware	>= 10.0.2.2 < 10.0.2.7	10.0.2.7
huawei	cd16-10_firmware	>= 10.0.2.3 < 10.0.2.5	10.0.2.5
huawei	cd17-10_firmware	>= 9.0.3.3 < 10.0.2.5	10.0.2.5
huawei	cd18-10_firmware	>= 9.0.2.23 < 10.0.2.5	10.0.2.5
huawei	hirouter-cd15-10_firmware	>= 9.0.2.3 < 10.0.2.5	10.0.2.5
huawei	hirouter-cd20-10_firmware	>= 9.0.3.9 < 10.0.2.6	10.0.2.6
huawei	hirouter-cd21-16_firmware	>= 9.0.3.9 < 10.0.2.5	10.0.2.5
huawei	hirouter-cd30-10_firmware	>= 10.0.2.8 < 10.0.2.9	10.0.2.9
huawei	hirouter-cd30-11_firmware	>= 10.0.2.8 < 10.0.2.9	10.0.2.9
huawei	hirouter-h1-10_firmware	>= 9.0.3.11 < 10.0.2.5	10.0.2.5
huawei	tc5200-10_firmware	>= 10.0.2.3 < 10.0.2.5	10.0.2.5
huawei	ws5100-10_firmware	>= 9.0.3.11 < 10.0.2.7	10.0.2.7
huawei	ws5102-10_firmware	>= 10.0.2.2 < 10.0.2.7	10.0.2.7
huawei	ws5106-10_firmware	>= 10.0.2.2 < 10.0.2.7	10.0.2.7
huawei	ws5108-10_firmware	>= 10.0.2.2 < 10.0.2.7	10.0.2.7
huawei	ws5200-10_firmware	>= 9.0.3.9 < 10.0.2.6	10.0.2.6
huawei	ws5200-11_firmware	—	—
huawei	ws5200-11_firmware	—	—
huawei	ws5280-10_firmware	>= 9.0.3.22 < 10.0.2.6	10.0.2.6
huawei	ws5280-11_firmware	>= 9.0.3.22 < 10.0.2.6	10.0.2.6
huawei	ws6500-10_firmware	>= 10.0.2.3 < 10.0.2.5	10.0.2.5
huawei	ws6500-11_firmware	>= 10.0.2.2 < 10.0.2.7	10.0.2.7
huawei	ws826-10_firmware	>= 9.0.3.11 < 10.0.2.5	10.0.2.5

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 4.6 MEDIUM AV:L/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.