Remote Code Execution Vulnerability in Huawei eSpace Products
CVE-2017-17222

8.8HIGH

Key Information:

Vendor
McAfee
Status
Espace 7950; Espace 8950
Vendor
CVE Published:
9 March 2018

Summary

The Import Language Package function of Huawei eSpace products, specifically versions 7950 V200R003C30 and 8950 V200R003C00, contains a vulnerability that allows authenticated remote attackers to execute arbitrary code. This threat arises from insufficient validation of packets after the Language Package is uploaded. Attackers could exploit this weakness by sending specially crafted packets, leading to unauthorized execution of code on the affected devices.

Affected Version(s)

eSpace 7950; eSpace 8950 eSpace 7950 V200R003C30

eSpace 7950; eSpace 8950 eSpace 8950 V200R003C00

eSpace 7950; eSpace 8950 V200R003C30

References

http://www.huawei.com/en/psirt/security-advisories/2018/h...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.