High severity · published Nov 29, 2019
CVE-2019-5269
Some Huawei home routers have an improper authorization vulnerability
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Some Huawei home routers have an improper authorization vulnerability. Due to improper authorization of certain programs, an attacker can exploit this vulnerability to execute uploaded malicious files and escalate privilege.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cd10-10 Firmware · Huawei
10.0.2.2 before 10.0.2.7 · source: NVD
CF
Cd16-10 Firmware · Huawei
10.0.2.3 before 10.0.2.5 · source: NVD
CF
Cd17-10 Firmware · Huawei
9.0.3.3 before 10.0.2.5 · source: NVD
CF
Cd18-10 Firmware · Huawei
9.0.2.23 before 10.0.2.5 · source: NVD
HF
Hirouter-cd15-10 Firmware · Huawei
9.0.2.3 before 10.0.2.5 · source: NVD
HF
Hirouter-cd20-10 Firmware · Huawei
9.0.3.9 before 10.0.2.6 · source: NVD
HF
Hirouter-cd21-16 Firmware · Huawei
9.0.3.9 before 10.0.2.5 · source: NVD
HF
Hirouter-cd30-10 Firmware · Huawei
10.0.2.8 before 10.0.2.9 · source: NVD
HF
Hirouter-cd30-11 Firmware · Huawei
10.0.2.8 before 10.0.2.9 · source: NVD
HF
Hirouter-h1-10 Firmware · Huawei
9.0.3.11 before 10.0.2.5 · source: NVD
TF
Tc5200-10 Firmware · Huawei
10.0.2.3 before 10.0.2.5 · source: NVD
WF
Ws5100-10 Firmware · Huawei
9.0.3.11 before 10.0.2.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5269
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191113-01-homerouter-en
More from Cd10-10 Firmware
8.1
CVE-2019-5268
Some Huawei home routers have an input validation vulnerability