Medium severity · published Feb 15, 2018
CVE-2017-15346
XML parser in Huawei S12700 V200R005C00,S1700 V200R009C00, V200R010C00,S3700 V100R006C03, V100R006C05,S5700 V200R001C00, V200R002C00, V200R003C00, V200R003C02, V200R005C00,…
4.7
CVSS
0.5%
EPSS
No
On KEV
Description
XML parser in Huawei S12700 V200R005C00,S1700 V200R009C00, V200R010C00,S3700 V100R006C03, V100R006C05,S5700 V200R001C00, V200R002C00, V200R003C00, V200R003C02, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,S6700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R005C02, V200R008C00, V200R009C00, V200R010C00,S7700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,S9700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, V200R009C00, V200R010C00,eCNS210_TD V100R004C10, V100R004C10SPC003, V100R004C10SPC100, V100R004C10SPC101, V100R004C10SPC102, V100R004C10SPC200, V100R004C10SPC221, V100R004C10SPC400 has a DOS vulnerability. An attacker may craft specific XML files to the affected products. Due to not check the specially XML file and to parse this file, successful exploit will result in DOS attacks.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ET
Ecns210 TD Firmware · Huawei
v100r004c10; v100r004c10spc003; v100r004c10spc100; v100r004c10spc101; v100r004c10spc102; v100r004c10spc200; +2 more · source: NVD
SF
S12700 Firmware · Huawei
v200r005c00 · source: NVD
SF
S1700 Firmware · Huawei
v200r009c00; v200r010c00 · source: NVD
SF
S5700 Firmware · Huawei
v200r001c00; v200r002c00; v200r003c00; v200r003c02; v200r005c00; v200r006c00; +4 more · source: NVD
SF
S6700 Firmware · Huawei
v200r001c00; v200r002c00; v200r003c00; v200r005c00; v200r005c02; v200r008c00; +10 more · source: NVD
SF
S7700 Firmware · Huawei
v200r001c00; v200r002c00; v200r003c00; v200r005c00; v200r006c00; v200r007c00; +3 more · source: NVD
SF
S9700 Firmware · Huawei
v200r001c00; v200r002c00; v200r003c00; v200r005c00; v200r006c00; v200r007c00; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-15346
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-15346
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171201-01-xml-en
More from Ecns210 TD Firmware
8.8
CVE-2017-2722
DP300 V500R002C00,TE60 with software V100R001C01, V100R001C10, V100R003C00, V500R002C00 and V600R006C00,TP3106 with software V100R001C06 and V100R002C00,ViewPoint 9030 with…
5.5
CVE-2017-15323
Huawei DP300 V500R002C00, NIP6600 V500R001C00, V500R001C20, V500R001C30, Secospace USG6500 V500R001C00, V500R001C20, V500R001C30, TE60 V100R001C01, V100R001C10, V100R003C00,…
4.7
CVE-2017-15333
XML parser in Huawei S12700 V200R005C00,S1700 V200R009C00, V200R010C00,S3700 V100R006C03, V100R006C05,S5700 V200R001C00, V200R002C00, V200R003C00, V200R003C02, V200R005C00,…