CVE-2020-9137

CWE-20 — Improper Input Validation3 documents3 sources

Severity

6.7MEDIUM

EPSS

0.0%

top 92.69%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Huawei Cloudengine 12800 Firmware Huawei Cloudengine 5800 Firmware Huawei Cloudengine 6800 Firmware +1 more

Timeline

PublishedDec 24

Latest updateMay 24

Description

There is a privilege escalation vulnerability in some versions of CloudEngine 12800,CloudEngine 5800,CloudEngine 6800 and CloudEngine 7800. Due to insufficient input validation, a local attacker with high privilege may execute some specially crafted scripts in the affected products. Successful exploit will cause privilege escalation.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages4 packages

▶NVDhuawei/cloudengine_5800_firmware6 versions+5

▶NVDhuawei/cloudengine_6800_firmware7 versions+6

▶NVDhuawei/cloudengine_7800_firmware6 versions+5

▶NVDhuawei/cloudengine_12800_firmware6 versions+5

🔴Vulnerability Details

GHSA

GHSA-2v2m-677r-5j24: There is a privilege escalation vulnerability in some versions of CloudEngine 12800,CloudEngine 5800,CloudEngine 6800 and CloudEngine 7800↗2022-05-24

▶

CVEList

CVE-2020-9137: There is a privilege escalation vulnerability in some versions of CloudEngine 12800,CloudEngine 5800,CloudEngine 6800 and CloudEngine 7800↗2020-12-24

▶