Medium severity · published Mar 5, 2018
CVE-2017-17137
PEM module of Huawei DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6300 V500R001C00; V500R001C30; NIP6600 V500R001C00;…
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
PEM module of Huawei DP300 V500R002C00; IPS Module V500R001C00; V500R001C30; NGFW Module V500R001C00; V500R002C00; NIP6300 V500R001C00; V500R001C30; NIP6600 V500R001C00; V500R001C30; RP200 V500R002C00; V600R006C00; S12700 V200R007C00; V200R007C01; V200R008C00; V200R009C00; V200R010C00; S1700 V200R006C10; V200R009C00; V200R010C00; S2700 V200R006C10; V200R007C00; V200R008C00; V200R009C00; V200R010C00; S5700 V200R006C00; V200R007C00; V200R008C00; V200R009C00; V200R010C00; S6700 V200R008C00; V200R009C00; V200R010C00; S7700 V200R007C00; V200R008C00; V200R009C00; V200R010C00; S9700 V200R007C00; V200R007C01; V200R008C00; V200R009C00; V200R010C00; Secospace USG6300 V500R001C00; V500R001C30; Secospace USG6500 V500R001C00; V500R001C30; Secospace USG6600 V500R001C00; V500R001C30S; TE30 V100R001C02; V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C01; V100R001C10; V500R002C00; V600R006C00; TP3106 V100R002C00; TP3206 V100R002C00; V100R002C10; USG9500 V500R001C00; V500R001C30; ViewPoint 9030 V100R011C02; V100R011C03 has an Out-of-Bounds memory access vulnerability due to insufficient verification. An authenticated local attacker can make processing crash by a malicious certificate. The attacker can exploit this vulnerability to cause a denial of service.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dp300 Firmware · Huawei
v500r002c00 · source: NVD
IM
Ips Module Firmware · Huawei
v500r001c00; v500r001c30 · source: NVD
NM
Ngfw Module Firmware · Huawei
v500r001c00; v500r002c00 · source: NVD
NF
Nip6300 Firmware · Huawei
v500r001c00; v500r001c30 · source: NVD
NF
Nip6600 Firmware · Huawei
v500r001c00; v500r001c30 · source: NVD
RF
Rp200 Firmware · Huawei
v500r002c00; v600r006c00 · source: NVD
SF
S12700 Firmware · Huawei
v200r007c00; v200r007c01; v200r008c00; v200r009c00; v200r010c00 · source: NVD
SF
S1700 Firmware · Huawei
v200r006c10; v200r009c00; v200r010c00 · source: NVD
SF
S2700 Firmware · Huawei
v200r006c10; v200r007c00; v200r008c00; v200r009c00; v200r010c00 · source: NVD
SF
S5700 Firmware · Huawei
v200r006c00; v200r007c00; v200r008c00; v200r009c00; v200r010c00 · source: NVD
SF
S6700 Firmware · Huawei
v200r008c00; v200r009c00; v200r010c00 · source: NVD
SF
S7700 Firmware · Huawei
v200r007c00; v200r008c00; v200r009c00; v200r010c00 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-17137
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-17137
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-01-pem-en
More from Dp300 Firmware
9.8
CVE-2017-17301
Huawei AR120-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, AR1200 V200R005C20, V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, AR1200-S…
8.8
CVE-2017-2722
DP300 V500R002C00,TE60 with software V100R001C01, V100R001C10, V100R003C00, V500R002C00 and V600R006C00,TP3106 with software V100R001C06 and V100R002C00,ViewPoint 9030 with…
7.8
CVE-2017-17146
Huawei DP300 V500R002C00 have a buffer overflow vulnerability due to the lack of validation
7.5
CVE-2019-19417
The SIP module of some Huawei products have a denial of service (DoS) vulnerability
7.5
CVE-2019-19416
The SIP module of some Huawei products have a denial of service (DoS) vulnerability