High severity · published Nov 29, 2019
CVE-2019-5268
Some Huawei home routers have an input validation vulnerability
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
Some Huawei home routers have an input validation vulnerability. Due to input parameter is not correctly verified, an attacker can exploit this vulnerability by sending special constructed packets to obtain files in the device and upload files to some directories.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cd10-10 Firmware · Huawei
10.0.2.2 before 10.0.2.7 · source: NVD
CF
Cd16-10 Firmware · Huawei
10.0.2.3 before 10.0.2.5 · source: NVD
CF
Cd17-10 Firmware · Huawei
9.0.3.3 before 10.0.2.5 · source: NVD
CF
Cd18-10 Firmware · Huawei
9.0.2.23 before 10.0.2.5 · source: NVD
HF
Hirouter-cd15-10 Firmware · Huawei
9.0.2.3 before 10.0.2.5 · source: NVD
HF
Hirouter-cd20-10 Firmware · Huawei
9.0.3.9 before 10.0.2.6 · source: NVD
HF
Hirouter-cd21-16 Firmware · Huawei
9.0.3.9 before 10.0.2.5 · source: NVD
HF
Hirouter-cd30-10 Firmware · Huawei
10.0.2.8 before 10.0.2.9 · source: NVD
HF
Hirouter-cd30-11 Firmware · Huawei
10.0.2.8 before 10.0.2.9 · source: NVD
HF
Hirouter-h1-10 Firmware · Huawei
9.0.3.11 before 10.0.2.5 · source: NVD
TF
Tc5200-10 Firmware · Huawei
10.0.2.3 before 10.0.2.5 · source: NVD
WF
Ws5100-10 Firmware · Huawei
9.0.3.11 before 10.0.2.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5268
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5268
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191113-01-homerouter-en
More from Cd10-10 Firmware
7.8
CVE-2019-5269
Some Huawei home routers have an improper authorization vulnerability