CVE-2020-9099

CWE-287 — Improper Authentication3 documents3 sources

Severity

9.8CRITICAL

EPSS

0.2%

top 62.98%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Huawei IPS Module Firmware Huawei Ngfw Module Firmware Huawei Nip6300 Firmware +6 more

Timeline

PublishedJun 8

Latest updateMay 24

Description

Huawei products IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospace USG6300; Secospace USG6500; Secospace USG6600; USG9500 with versions of V500R001C00; V500R001C20; V500R001C30; V500R001C50; V500R001C60; V500R001C80; V500R005C00; V500R005C10; V500R005C20; V500R002C00; V500R002C10; V500R002C20; V500R002C30 have an improper authentication vulnerability. Attackers need to perform some operations to exploit the vulnerability. Successful exploit may obtain certain permissions on the device…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages9 packages

▶NVDhuawei/secospace_usg6300_firmware9 versions+8

▶NVDhuawei/secospace_usg6500_firmware9 versions+8

▶NVDhuawei/secospace_usg6600_firmware9 versions+8

▶NVDhuawei/ngfw_module_firmware12 versions+11

▶NVDhuawei/ips_module_firmware9 versions+8

🔴Vulnerability Details

GHSA

GHSA-pch4-qpxr-f8xh: Huawei products IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospace USG6300; Secospace USG6500; Secospace USG6600; USG9500 with versions of↗2022-05-24

▶

CVEList

CVE-2020-9099: Huawei products IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospace USG6300; Secospace USG6500; Secospace USG6600; USG9500 with versions of↗2020-06-08

▶