← Back

CVE-2017-17221

nvd nist
Published: Mar 9, 2018Modified: Nov 21, 2024

JSON object

Loading...
8.8
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD

Description

Import Signal Tone function in Huawei eSpace 7950 V200R003C30; eSpace 8950 V200R003C00; V200R003C30 has a remote code execution vulnerability. An authenticated, remote attacker can craft and send the packets to the affected products after the Signal Tone is uploaded. Due to insufficient verification of the packets, this could be exploited to execute arbitrary code.

Affected (3)

Huawei
2 products
Espace 7950 Firmware
Espace 8950 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Espace 7950 Firmware
Version v200r003c30
Running on/withPlatform Versions
Huawei
Espace 7950
All versions
Configuration B
2 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Huawei
Espace 8950 Firmware
Version v200r003c00
Espace 8950 Firmware
Version v200r003c30
Running on/withPlatform Versions
Huawei
Espace 8950
All versions

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

Source: psirt@huawei.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.