High severity · published Aug 17, 2020
CVE-2020-9241
Huawei 5G Mobile WiFi E6878-370 with versions of 10.0.3.1(H563SP1C00),10.0.3.1(H563SP21C233) have an improper authorization vulnerability
7.0
CVSS
0.5%
EPSS
No
On KEV
Description
Huawei 5G Mobile WiFi E6878-370 with versions of 10.0.3.1(H563SP1C00),10.0.3.1(H563SP21C233) have an improper authorization vulnerability. The device does not restrict certain data received from WAN port. Successful exploit could allow an attacker at WAN side to manage certain service of the device.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EF
E6878-370 Firmware · Huawei
10.0.3.1(h563sp1c00); 10.0.3.1(h563sp21c233) · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9241
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9241
Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200812-01-auth-en
More from E6878-370 Firmware
8.8
CVE-2020-1832
E6878-370 products with versions of 10.0.3.1(H557SP27C233) and 10.0.3.1(H563SP1C00) have a stack buffer overflow vulnerability
7.5
CVE-2020-1799
E6878-370 with versions of 10.0.3.1(H557SP27C233), 10.0.3.1(H563SP1C00), 10.0.3.1(H563SP1C233) has a use after free vulnerability
6.5
CVE-2020-9069
There is an information leakage vulnerability in some Huawei products
4.5
CVE-2020-9111
E6878-370 versions 10.0.3.1(H557SP27C233),10.0.3.1(H563SP21C233) and E6878-870 versions 10.0.3.1(H557SP27C233),10.0.3.1(H563SP11C233) have a denial of service vulnerability