← Back

CVE-2017-17330

nvd nist
Published: Mar 9, 2018Modified: Nov 21, 2024

JSON object

Loading...
3.3
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Exploitability: 1.8 / Impact: 1.4
Source: NVD

Description

Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory.

Affected (13)

Huawei
2 products
Ar3200 Firmware
Ngfw Module Firmware
Configuration A
10 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Huawei
Ar3200 Firmware
Version v200r005c32
Ar3200 Firmware
Version v200r006c10
Ar3200 Firmware
Version v200r006c11
Ar3200 Firmware
Version v200r007c00
Ar3200 Firmware
Version v200r007c01
Ar3200 Firmware
Version v200r007c02
Ar3200 Firmware
Version v200r008c00
Ar3200 Firmware
Version v200r008c10
Ar3200 Firmware
Version v200r008c20
Ar3200 Firmware
Version v200r008c30
Running on/withPlatform Versions
Huawei
Ar3200
All versions
Configuration B
3 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Huawei
Ngfw Module Firmware
Version v500r001c00
Ngfw Module Firmware
Version v500r001c20
Ngfw Module Firmware
Version v500r002c00
Running on/withPlatform Versions
Huawei
Ngfw Module
All versions

Related CWEs

CWE-772
Missing Release of Resource after Effective Lifetime
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

References (2)

Source: psirt@huawei.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.