CVE-2018-7994

Published: Jul 31, 2018Modified: Jun 17, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Some Huawei products IPS Module V500R001C50; NGFW Module V500R001C50; V500R002C10; NIP6300 V500R001C50; NIP6600 V500R001C50; NIP6800 V500R001C50; Secospace USG6600 V500R001C50; USG9500 V500R001C50 have a memory leak vulnerability. The software does not release allocated memory properly when processing Protal questionnaire. A remote attacker could send a lot questionnaires to the device, successful exploit could cause the device to reboot since running out of memory.

Affected (8)

Products: Huawei: Ips Module, Ngfw Module, Nip6300, Nip6600, Nip6800, Secospace Usg6600, Usg9500

7 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ips Module	Version v500r001c50

Running on/with	Platform Versions
Huawei Ips Module	All versions

Configuration B

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ngfw Module	Version v500r001c50
Huawei Ngfw Module	Version v500r002c10

Running on/with	Platform Versions
Huawei Ngfw Module	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Nip6300	Version v500r001c50

Running on/with	Platform Versions
Huawei Nip6300	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Nip6600	Version v500r001c50

Running on/with	Platform Versions
Huawei Nip6600	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Nip6800	Version v500r001c50

Running on/with	Platform Versions
Huawei Nip6800	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Secospace Usg6600	Version v500r001c50

Running on/with	Platform Versions
Huawei Secospace Usg6600	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Usg9500	Version v500r001c50

Running on/with	Platform Versions
Huawei Usg9500	All versions

Related CWEs

CWE-772

Missing Release of Resource after Effective Lifetime

The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

References (2)

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180704-01-firewall-en

Source: psirt@huawei.com

Vendor Advisory

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180704-01-firewall-en

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.