CVE-2018-7920 - OpenCVE

Huawei AR1200 V200R006C10SPC300, AR160 V200R006C10SPC300, AR200 V200R006C10SPC300, AR2200 V200R006C10SPC300, AR3200 V200R006C10SPC300 devices have an improper resource management vulnerability. Due to the improper implementation of ACL mechanism, a remote attacker may send TCP messages to the management interface of the affected device to exploit this vulnerability. Successful exploit could exhaust the socket resource of management interface, leading to a DoS condition.

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

AV:N/AC:L/Au:N/C:N/I:N/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Huawei	Ar200 Firmware Ar200 Ar1200 Ar160 Ar2200 Firmware Ar3200 Firmware Ar160 Firmware Ar3200 Ar2200 Ar1200 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:huawei:ar1200_firmware:v200r006c10spc300:*:*:*:*:*:*:*

cpe:2.3:h:huawei:ar1200:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:huawei:ar160_firmware:v200r006c10spc300:*:*:*:*:*:*:*

cpe:2.3:h:huawei:ar160:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:huawei:ar200_firmware:v200r006c10spc300:*:*:*:*:*:*:*

cpe:2.3:h:huawei:ar200:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:huawei:ar2200_firmware:v200r006c10spc300:*:*:*:*:*:*:*

cpe:2.3:h:huawei:ar2200:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:huawei:ar3200_firmware:v200r006c10spc300:*:*:*:*:*:*:*

cpe:2.3:h:huawei:ar3200:-:*:*:*:*:*:*:*

References

Link	Resource
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180418-01-ar-en	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: huawei

Published: 2018-04-18T00:00:00

Updated: 2018-04-19T13:57:01

Reserved: 2018-03-09T00:00:00

Link: CVE-2018-7920

JSON object: View

NVD Information

Status : Analyzed

Published: 2018-04-19T14:29:00.607

Modified: 2018-05-22T16:39:25.320

Link: CVE-2018-7920

JSON object: View

Redhat Information

No data.

CWE

CWE-400

{"containers": {"cna": {"affected": [{"product": "AR1200, AR160, AR200, AR2200, AR3200", "vendor": "Huawei Technologies Co., Ltd.", "versions": [{"status": "affected", "version": "V200R006C10SPC300, V200R006C10SPC300, V200R006C10SPC300, V200R006C10SPC300, V200R006C10SPC300"}]}], "datePublic": "2018-04-18T00:00:00", "descriptions": [{"lang": "en", "value": "Huawei AR1200 V200R006C10SPC300, AR160 V200R006C10SPC300, AR200 V200R006C10SPC300, AR2200 V200R006C10SPC300, AR3200 V200R006C10SPC300 devices have an improper resource management vulnerability. Due to the improper implementation of ACL mechanism, a remote attacker may send TCP messages to the management interface of the affected device to exploit this vulnerability. Successful exploit could exhaust the socket resource of management interface, leading to a DoS condition."}], "problemTypes": [{"descriptions": [{"description": "improper resource management", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-04-19T13:57:01", "orgId": "25ac1063-e409-4190-8079-24548c77ea2e", "shortName": "huawei"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180418-01-ar-en"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@huawei.com", "DATE_PUBLIC": "2018-04-18T00:00:00", "ID": "CVE-2018-7920", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "AR1200, AR160, AR200, AR2200, AR3200", "version": {"version_data": [{"version_value": "V200R006C10SPC300, V200R006C10SPC300, V200R006C10SPC300, V200R006C10SPC300, V200R006C10SPC300"}]}}]}, "vendor_name": "Huawei Technologies Co., Ltd."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Huawei AR1200 V200R006C10SPC300, AR160 V200R006C10SPC300, AR200 V200R006C10SPC300, AR2200 V200R006C10SPC300, AR3200 V200R006C10SPC300 devices have an improper resource management vulnerability. Due to the improper implementation of ACL mechanism, a remote attacker may send TCP messages to the management interface of the affected device to exploit this vulnerability. Successful exploit could exhaust the socket resource of management interface, leading to a DoS condition."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "improper resource management"}]}]}, "references": {"reference_data": [{"name": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180418-01-ar-en", "refsource": "CONFIRM", "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180418-01-ar-en"}]}}}}, "cveMetadata": {"assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e", "assignerShortName": "huawei", "cveId": "CVE-2018-7920", "datePublished": "2018-04-18T00:00:00", "dateReserved": "2018-03-09T00:00:00", "dateUpdated": "2018-04-19T13:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:ar1200_firmware:v200r006c10spc300:*:*:*:*:*:*:*", "matchCriteriaId": "BB95E2F8-B775-41CC-8C25-30B4E0A6C546", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:huawei:ar1200:-:*:*:*:*:*:*:*", "matchCriteriaId": "D4BA4150-8CA8-48BF-9D45-ABC8AC710060", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:ar160_firmware:v200r006c10spc300:*:*:*:*:*:*:*", "matchCriteriaId": "8A542A66-2C65-4001-B5C4-49E258C1A0EE", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:huawei:ar160:-:*:*:*:*:*:*:*", "matchCriteriaId": "137A007D-A498-483F-8B4F-DCA118B25F11", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:ar200_firmware:v200r006c10spc300:*:*:*:*:*:*:*", "matchCriteriaId": "006C9C6D-5BB9-43C9-975E-42890440738F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:huawei:ar200:-:*:*:*:*:*:*:*", "matchCriteriaId": "2562CCF8-A4A7-4ACD-AA67-E3DB8B5ADA92", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:ar2200_firmware:v200r006c10spc300:*:*:*:*:*:*:*", "matchCriteriaId": "9808010D-8332-40E2-B2CC-4BFEA895F0C9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:huawei:ar2200:-:*:*:*:*:*:*:*", "matchCriteriaId": "50662078-4827-4706-AE29-170E2239C5AE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:ar3200_firmware:v200r006c10spc300:*:*:*:*:*:*:*", "matchCriteriaId": "E8D59BD5-28F6-45ED-9305-F1B61DE3157D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:huawei:ar3200:-:*:*:*:*:*:*:*", "matchCriteriaId": "9309E1AA-0C4E-422C-9307-A8DD0AE5D576", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Huawei AR1200 V200R006C10SPC300, AR160 V200R006C10SPC300, AR200 V200R006C10SPC300, AR2200 V200R006C10SPC300, AR3200 V200R006C10SPC300 devices have an improper resource management vulnerability. Due to the improper implementation of ACL mechanism, a remote attacker may send TCP messages to the management interface of the affected device to exploit this vulnerability. Successful exploit could exhaust the socket resource of management interface, leading to a DoS condition."}, {"lang": "es", "value": "Los dispositivos Huawei AR1200 V200R006C10SPC300, AR160 V200R006C10SPC300, AR200 V200R006C10SPC300, AR2200 V200R006C10SPC300 y AR3200 V200R006C10SPC300 tienen una vulnerabilidad de gesti\u00f3n incorrecta de recursos. Debido a la implementaci\u00f3n incorrecta del mecanismo de lista de control de acceso (ACL), un atacante remoto podr\u00eda enviar mensajes TCP a la interfaz de gesti\u00f3n del dispositivo afectado para explotar esta vulnerabilidad. Un exploit con \u00e9xito podr\u00eda agotar el recurso socket de la interfaz de gesti\u00f3n, lo que conduce a una condici\u00f3n de denegaci\u00f3n de servicio (DoS)."}], "id": "CVE-2018-7920", "lastModified": "2018-05-22T16:39:25.320", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-04-19T14:29:00.607", "references": [{"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180418-01-ar-en"}], "sourceIdentifier": "psirt@huawei.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "nvd@nist.gov", "type": "Primary"}]}