CVE-2019-5291

Published: Dec 13, 2019Modified: Jun 17, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

Some Huawei products have an insufficient verification of data authenticity vulnerability. A remote, unauthenticated attacker has to intercept specific packets between two devices, modify the packets, and send the modified packets to the peer device. Due to insufficient verification of some fields in the packets, an attacker may exploit the vulnerability to cause the target device to be abnormal.

Affected (69)

Products: Huawei: Ar120 S Firmware, Ar1200 Firmware, Ar1200 S Firmware, Ar150 Firmware, Ar150 S Firmware, Ar160 Firmware, Ar200 Firmware, Ar200 S Firmware, Ar2200 Firmware, Ar2200 S Firmware, Ar3200 Firmware, Ar3600 Firmware, Cloudengine 12800 Firmware, Netengine16ex Firmware, S6700 Firmware, Srg1300 Firmware, Srg2300 Firmware, Srg3300 Firmware

18 products

Cloudengine 12800 Firmware

Netengine16ex Firmware

Configuration A

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ar120 S Firmware	Version v200r005c20
Huawei Ar120 S Firmware	Version v200r006c10
Huawei Ar120 S Firmware	Version v200r007c00
Huawei Ar120 S Firmware	Version v200r008c50

Running on/with	Platform Versions
Huawei Ar120 S	All versions

Configuration B

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ar1200 Firmware	Version v200r005c00
Huawei Ar1200 Firmware	Version v200r006c10
Huawei Ar1200 Firmware	Version v200r007c00
Huawei Ar1200 Firmware	Version v200r008c50

Running on/with	Platform Versions
Huawei Ar1200	All versions

Configuration C

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ar1200 S Firmware	Version v200r005c20
Huawei Ar1200 S Firmware	Version v200r006c10
Huawei Ar1200 S Firmware	Version v200r007c00
Huawei Ar1200 S Firmware	Version v200r008c50

Running on/with	Platform Versions
Huawei Ar1200 S	All versions

Configuration D

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ar150 Firmware	Version v200r005c20
Huawei Ar150 Firmware	Version v200r006c10
Huawei Ar150 Firmware	Version v200r007c00
Huawei Ar150 Firmware	Version v200r008c50

Running on/with	Platform Versions
Huawei Ar150	All versions

Configuration E

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ar150 S Firmware	Version v200r005c20
Huawei Ar150 S Firmware	Version v200r006c10
Huawei Ar150 S Firmware	Version v200r007c00
Huawei Ar150 S Firmware	Version v200r008c50

Running on/with	Platform Versions
Huawei Ar150 S	All versions

Configuration F

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ar160 Firmware	Version v200r005c20
Huawei Ar160 Firmware	Version v200r006c10
Huawei Ar160 Firmware	Version v200r007c00
Huawei Ar160 Firmware	Version v200r008c50

Running on/with	Platform Versions
Huawei Ar160	All versions

Configuration G

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ar200 Firmware	Version v200r005c20
Huawei Ar200 Firmware	Version v200r006c10
Huawei Ar200 Firmware	Version v200r007c00
Huawei Ar200 Firmware	Version v200r008c50

Running on/with	Platform Versions
Huawei Ar200	All versions

Configuration H

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ar200 S Firmware	Version v200r005c20
Huawei Ar200 S Firmware	Version v200r006c10
Huawei Ar200 S Firmware	Version v200r007c00
Huawei Ar200 S Firmware	Version v200r008c50

Running on/with	Platform Versions
Huawei Ar200 S	All versions

Configuration I

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ar2200 Firmware	Version v200r005c20
Huawei Ar2200 Firmware	Version v200r006c10
Huawei Ar2200 Firmware	Version v200r007c00
Huawei Ar2200 Firmware	Version v200r008c50

Running on/with	Platform Versions
Huawei Ar2200	All versions

Configuration J

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ar2200 S Firmware	Version v200r005c20
Huawei Ar2200 S Firmware	Version v200r006c10
Huawei Ar2200 S Firmware	Version v200r007c00
Huawei Ar2200 S Firmware	Version v200r008c50

Running on/with	Platform Versions
Huawei Ar2200 S	All versions

Configuration K

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ar3200 Firmware	Version v200r005c20
Huawei Ar3200 Firmware	Version v200r006c10
Huawei Ar3200 Firmware	Version v200r007c00
Huawei Ar3200 Firmware	Version v200r008c50

Running on/with	Platform Versions
Huawei Ar3200	All versions

Configuration L

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Ar3600 Firmware	Version v200r006c10
Huawei Ar3600 Firmware	Version v200r007c00
Huawei Ar3600 Firmware	Version v200r008c50

Running on/with	Platform Versions
Huawei Ar3600	All versions

Configuration M

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Cloudengine 12800 Firmware	Version v200r002c10
Huawei Cloudengine 12800 Firmware	Version v200r002c20

Running on/with	Platform Versions
Huawei Cloudengine 12800	All versions

Configuration N

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Netengine16ex Firmware	Version v200r005c20
Huawei Netengine16ex Firmware	Version v200r006c10
Huawei Netengine16ex Firmware	Version v200r007c00
Huawei Netengine16ex Firmware	Version v200r008c50

Running on/with	Platform Versions
Huawei Netengine16ex	All versions

Configuration O

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei S6700 Firmware	Version v200r008c00
Huawei S6700 Firmware	Version v200r010c00spc300
Huawei S6700 Firmware	Version v200r010c00spc600
Huawei S6700 Firmware	Version v200r011c00spc200

Running on/with	Platform Versions
Huawei S6700	All versions

Configuration P

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Srg1300 Firmware	Version v200r005c20
Huawei Srg1300 Firmware	Version v200r006c10
Huawei Srg1300 Firmware	Version v200r007c00
Huawei Srg1300 Firmware	Version v200r008c50

Running on/with	Platform Versions
Huawei Srg1300	All versions

Configuration Q

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Srg2300 Firmware	Version v200r005c20
Huawei Srg2300 Firmware	Version v200r006c10
Huawei Srg2300 Firmware	Version v200r007c00
Huawei Srg2300 Firmware	Version v200r008c50

Running on/with	Platform Versions
Huawei Srg2300	All versions

Configuration R

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Huawei Srg3300 Firmware	Version v200r005c20
Huawei Srg3300 Firmware	Version v200r006c10
Huawei Srg3300 Firmware	Version v200r007c00
Huawei Srg3300 Firmware	Version v200r008c50

Running on/with	Platform Versions
Huawei Srg3300	All versions

Related CWEs

CWE-345

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (2)

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-validation-en

Source: psirt@huawei.com

Vendor Advisory

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-validation-en

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.