Login Request a demo
Medium severity · published Dec 13, 2019
CVE-2019-5291
Some Huawei products have an insufficient verification of data authenticity vulnerability
5.9
CVSS
0.4%
EPSS
No
On KEV
Description
Some Huawei products have an insufficient verification of data authenticity vulnerability. A remote, unauthenticated attacker has to intercept specific packets between two devices, modify the packets, and send the modified packets to the peer device. Due to insufficient verification of some fields in the packets, an attacker may exploit the vulnerability to cause the target device to be abnormal.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Ar120-s Firmware · Huawei
v200r005c20; v200r006c10; v200r007c00; v200r008c50 · source: NVD
AF
Ar1200 Firmware · Huawei
v200r005c00; v200r006c10; v200r007c00; v200r008c50 · source: NVD
AF
Ar1200-s Firmware · Huawei
v200r005c20; v200r006c10; v200r007c00; v200r008c50 · source: NVD
AF
Ar150 Firmware · Huawei
v200r005c20; v200r006c10; v200r007c00; v200r008c50 · source: NVD
AF
Ar150-s Firmware · Huawei
v200r005c20; v200r006c10; v200r007c00; v200r008c50 · source: NVD
AF
Ar160 Firmware · Huawei
v200r005c20; v200r006c10; v200r007c00; v200r008c50 · source: NVD
AF
Ar200 Firmware · Huawei
v200r005c20; v200r006c10; v200r007c00; v200r008c50 · source: NVD
AF
Ar200-s Firmware · Huawei
v200r005c20; v200r006c10; v200r007c00; v200r008c50 · source: NVD
AF
Ar2200 Firmware · Huawei
v200r005c20; v200r006c10; v200r007c00; v200r008c50 · source: NVD
AF
Ar2200-s Firmware · Huawei
v200r005c20; v200r006c10; v200r007c00; v200r008c50 · source: NVD
AF
Ar3200 Firmware · Huawei
v200r005c20; v200r006c10; v200r007c00; v200r008c50 · source: NVD
AF
Ar3600 Firmware · Huawei
v200r006c10; v200r007c00; v200r008c50 · source: NVD
Affected product
AF
Ar120-s Firmware
Huawei
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5291
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5291
Vendor Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-validation-en
More from Ar120-s Firmware
9.8
CVE-2017-17301
Huawei AR120-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, AR1200 V200R005C20, V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, AR1200-S…
7.5
CVE-2019-19417
The SIP module of some Huawei products have a denial of service (DoS) vulnerability
7.5
CVE-2019-19416
The SIP module of some Huawei products have a denial of service (DoS) vulnerability
7.5
CVE-2019-19415
The SIP module of some Huawei products have a denial of service (DoS) vulnerability
7.5
CVE-2019-5304
Some Huawei products have a buffer error vulnerability