CVE-2016-8781 - OpenCVE

Huawei Secospace USG6300 with software V500R001C20 and V500R001C20SPC200PWE, Secospace USG6500 with software V500R001C20, Secospace USG6600 with software V500R001C20 and V500R001C20SPC200PWE allow remote attackers with specific permission to log in to a device and deliver a large number of unspecified commands to exhaust memory, causing a DoS condition.

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

AV:N/AC:L/Au:S/C:N/I:N/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Huawei	Secospace Usg6600 Firmware Secospace Usg6300 Secospace Usg6500 Firmware Secospace Usg6600 Secospace Usg6300 Firmware Secospace Usg6500

Configuration 1 [-]

AND

OR	cpe:2.3:o:huawei:secospace_usg6300_firmware:v500r001c20:::::::*
	cpe:2.3:o:huawei:secospace_usg6300_firmware:v500r001c20spc200pwe:::::::*

cpe:2.3:h:huawei:secospace_usg6300:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:huawei:secospace_usg6500_firmware:v500r001c20:*:*:*:*:*:*:*

cpe:2.3:h:huawei:secospace_usg6500:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

OR	cpe:2.3:o:huawei:secospace_usg6600_firmware:v500r001c20:::::::*
	cpe:2.3:o:huawei:secospace_usg6600_firmware:v500r001c20spc200pwe:::::::*

cpe:2.3:h:huawei:secospace_usg6600:-:*:*:*:*:*:*:*

References

Link	Resource
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161214-01-firewall-en	Vendor Advisory
http://www.securityfocus.com/bid/94927	Third Party Advisory VDB Entry

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: huawei

Published: 2017-04-02T20:00:00

Updated: 2017-04-03T09:57:01

Reserved: 2016-10-18T00:00:00

Link: CVE-2016-8781

JSON object: View

NVD Information

Status : Analyzed

Published: 2017-04-02T20:59:01.593

Modified: 2017-04-05T23:57:11.137

Link: CVE-2016-8781

JSON object: View

Redhat Information

No data.

CWE

CWE-399

{"containers": {"cna": {"affected": [{"product": "Secospace USG6300, Secospace USG6500, Secospace USG6600 Secospace USG6300 V500R001C20 and V500R001C20SPC200PWE,Secospace USG6500 V500R001C20,Secospace USG6600 V500R001C20 and V500R001C20SPC200PWE", "vendor": "n/a", "versions": [{"status": "affected", "version": "Secospace USG6300, Secospace USG6500, Secospace USG6600 Secospace USG6300 V500R001C20 and V500R001C20SPC200PWE,Secospace USG6500 V500R001C20,Secospace USG6600 V500R001C20 and V500R001C20SPC200PWE"}]}], "datePublic": "2017-03-27T00:00:00", "descriptions": [{"lang": "en", "value": "Huawei Secospace USG6300 with software V500R001C20 and V500R001C20SPC200PWE, Secospace USG6500 with software V500R001C20, Secospace USG6600 with software V500R001C20 and V500R001C20SPC200PWE allow remote attackers with specific permission to log in to a device and deliver a large number of unspecified commands to exhaust memory, causing a DoS condition."}], "problemTypes": [{"descriptions": [{"description": "denial of service", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-04-03T09:57:01", "orgId": "25ac1063-e409-4190-8079-24548c77ea2e", "shortName": "huawei"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161214-01-firewall-en"}, {"name": "94927", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/94927"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@huawei.com", "ID": "CVE-2016-8781", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Secospace USG6300, Secospace USG6500, Secospace USG6600 Secospace USG6300 V500R001C20 and V500R001C20SPC200PWE,Secospace USG6500 V500R001C20,Secospace USG6600 V500R001C20 and V500R001C20SPC200PWE", "version": {"version_data": [{"version_value": "Secospace USG6300, Secospace USG6500, Secospace USG6600 Secospace USG6300 V500R001C20 and V500R001C20SPC200PWE,Secospace USG6500 V500R001C20,Secospace USG6600 V500R001C20 and V500R001C20SPC200PWE"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Huawei Secospace USG6300 with software V500R001C20 and V500R001C20SPC200PWE, Secospace USG6500 with software V500R001C20, Secospace USG6600 with software V500R001C20 and V500R001C20SPC200PWE allow remote attackers with specific permission to log in to a device and deliver a large number of unspecified commands to exhaust memory, causing a DoS condition."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "denial of service"}]}]}, "references": {"reference_data": [{"name": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161214-01-firewall-en", "refsource": "CONFIRM", "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161214-01-firewall-en"}, {"name": "94927", "refsource": "BID", "url": "http://www.securityfocus.com/bid/94927"}]}}}}, "cveMetadata": {"assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e", "assignerShortName": "huawei", "cveId": "CVE-2016-8781", "datePublished": "2017-04-02T20:00:00", "dateReserved": "2016-10-18T00:00:00", "dateUpdated": "2017-04-03T09:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:secospace_usg6300_firmware:v500r001c20:*:*:*:*:*:*:*", "matchCriteriaId": "11CAA59E-F2A8-4E84-BCC5-CADA8FDA9712", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:secospace_usg6300_firmware:v500r001c20spc200pwe:*:*:*:*:*:*:*", "matchCriteriaId": "C9429428-8612-4845-97DD-BB21F536D5C1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:huawei:secospace_usg6300:-:*:*:*:*:*:*:*", "matchCriteriaId": "C281B511-7A27-4FC6-9427-AE5AD7C302F3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:secospace_usg6500_firmware:v500r001c20:*:*:*:*:*:*:*", "matchCriteriaId": "B3983A57-2F07-4D21-9093-1DFEAB310E26", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:huawei:secospace_usg6500:-:*:*:*:*:*:*:*", "matchCriteriaId": "0ED6E342-26E7-45DF-AC3F-EFEBAE3DDDF0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:secospace_usg6600_firmware:v500r001c20:*:*:*:*:*:*:*", "matchCriteriaId": "A638ACAF-9A6F-4861-8CDB-E43FBC3C9C5B", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:secospace_usg6600_firmware:v500r001c20spc200pwe:*:*:*:*:*:*:*", "matchCriteriaId": "F0EE488E-AB7D-4945-8D97-37BF2CA14505", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:huawei:secospace_usg6600:-:*:*:*:*:*:*:*", "matchCriteriaId": "BE469876-F873-4705-9760-097AE840A818", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Huawei Secospace USG6300 with software V500R001C20 and V500R001C20SPC200PWE, Secospace USG6500 with software V500R001C20, Secospace USG6600 with software V500R001C20 and V500R001C20SPC200PWE allow remote attackers with specific permission to log in to a device and deliver a large number of unspecified commands to exhaust memory, causing a DoS condition."}, {"lang": "es", "value": "Huawei Secospace USG6300 con software V500R001C20 y V500R001C20SPC200PWE, Secospace USG6500 con software V500R001C20, Secospace USG6600 con software V500R001C20 y V500R001C20SPC200PWE permiten a atacantes remotos con permiso espec\u00edfico iniciar sesi\u00f3n en un dispositivo y entregar un gran n\u00famero de comandos no especificados para agotar la memoria, causando una condici\u00f3n DoS."}], "id": "CVE-2016-8781", "lastModified": "2017-04-05T23:57:11.137", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-04-02T20:59:01.593", "references": [{"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161214-01-firewall-en"}, {"source": "psirt@huawei.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/94927"}], "sourceIdentifier": "psirt@huawei.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-399"}], "source": "nvd@nist.gov", "type": "Primary"}]}