CVE-2020-1855 - OpenCVE

Huawei HEGE-570 version 1.0.1.22(SP3); and HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X version 1.0.1.21(SP3) have an insufficient verification vulnerability. An attacker can access the device physically and exploit this vulnerability to tamper with device information. Successful exploit may cause service abnormal.

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Partial

AV:L/AC:L/Au:N/C:N/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Huawei	Hege-560 Firmware Osca-550 Firmware Osca-550x Hege-570 Osca-550 Hege-560 Osca-550ax Firmware Osca-550x Firmware Osca-550a Firmware Osca-550ax Hege-570 Firmware Osca-550a

Configuration 1 [-]

AND

cpe:2.3:o:huawei:hege-560_firmware:1.0.1.21\(sp3\):*:*:*:*:*:*:*

cpe:2.3:h:huawei:hege-560:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:huawei:osca-550_firmware:1.0.1.21\(sp3\):*:*:*:*:*:*:*

cpe:2.3:h:huawei:osca-550:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:huawei:osca-550a_firmware:1.0.1.21\(sp3\):*:*:*:*:*:*:*

cpe:2.3:h:huawei:osca-550a:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:huawei:osca-550ax_firmware:1.0.1.21\(sp3\):*:*:*:*:*:*:*

cpe:2.3:h:huawei:osca-550ax:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:huawei:osca-550x_firmware:1.0.1.21\(sp3\):*:*:*:*:*:*:*

cpe:2.3:h:huawei:osca-550x:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:huawei:hege-570_firmware:1.0.1.22\(sp3\):*:*:*:*:*:*:*

cpe:2.3:h:huawei:hege-570:-:*:*:*:*:*:*:*

References

Link	Resource
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-03-osca-en	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: huawei

Published: 2020-02-18T02:28:18

Updated: 2020-02-18T02:28:18

Reserved: 2019-11-29T00:00:00

Link: CVE-2020-1855

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-02-18T03:15:11.277

Modified: 2021-07-21T11:39:23.747

Link: CVE-2020-1855

JSON object: View

Redhat Information

No data.

CWE

NVD-CWE-noinfo

{"containers": {"cna": {"affected": [{"product": "HEGE-570", "vendor": "Huawei", "versions": [{"status": "affected", "version": "1.0.1.22(SP3)"}]}, {"product": "HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, OSCA-550X", "vendor": "Huawei", "versions": [{"status": "affected", "version": "1.0.1.21(SP3)"}]}], "descriptions": [{"lang": "en", "value": "Huawei HEGE-570 version 1.0.1.22(SP3); and HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X version 1.0.1.21(SP3) have an insufficient verification vulnerability. An attacker can access the device physically and exploit this vulnerability to tamper with device information. Successful exploit may cause service abnormal."}], "problemTypes": [{"descriptions": [{"description": "Insufficient Verification", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-02-18T02:28:18", "orgId": "25ac1063-e409-4190-8079-24548c77ea2e", "shortName": "huawei"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-03-osca-en"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@huawei.com", "ID": "CVE-2020-1855", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "HEGE-570", "version": {"version_data": [{"version_value": "1.0.1.22(SP3)"}]}}, {"product_name": "HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, OSCA-550X", "version": {"version_data": [{"version_value": "1.0.1.21(SP3)"}]}}]}, "vendor_name": "Huawei"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Huawei HEGE-570 version 1.0.1.22(SP3); and HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X version 1.0.1.21(SP3) have an insufficient verification vulnerability. An attacker can access the device physically and exploit this vulnerability to tamper with device information. Successful exploit may cause service abnormal."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Insufficient Verification"}]}]}, "references": {"reference_data": [{"name": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-03-osca-en", "refsource": "CONFIRM", "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-03-osca-en"}]}}}}, "cveMetadata": {"assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e", "assignerShortName": "huawei", "cveId": "CVE-2020-1855", "datePublished": "2020-02-18T02:28:18", "dateReserved": "2019-11-29T00:00:00", "dateUpdated": "2020-02-18T02:28:18", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:hege-560_firmware:1.0.1.21\\(sp3\\):*:*:*:*:*:*:*", "matchCriteriaId": "6C033281-C8B1-48AF-A8E8-30863E778C10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:huawei:hege-560:-:*:*:*:*:*:*:*", "matchCriteriaId": "3325D5D9-8956-4335-B616-C553BF885152", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:osca-550_firmware:1.0.1.21\\(sp3\\):*:*:*:*:*:*:*", "matchCriteriaId": "5785116E-F7CF-49BA-8833-98913F81630C", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:huawei:osca-550:-:*:*:*:*:*:*:*", "matchCriteriaId": "C0D0122F-89FF-4B3E-8837-2E07A0D27105", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:osca-550a_firmware:1.0.1.21\\(sp3\\):*:*:*:*:*:*:*", "matchCriteriaId": "B2A17B82-6007-416F-8EB8-19A73EDEF52B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:huawei:osca-550a:-:*:*:*:*:*:*:*", "matchCriteriaId": "5D4E574D-DEFF-48CC-81F0-28DB6432EF13", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:osca-550ax_firmware:1.0.1.21\\(sp3\\):*:*:*:*:*:*:*", "matchCriteriaId": "EAFE434F-2C9A-4B04-A916-0E9BBB940EDF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:huawei:osca-550ax:-:*:*:*:*:*:*:*", "matchCriteriaId": "62EEE25C-2FA4-4B64-9680-387380D97352", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:osca-550x_firmware:1.0.1.21\\(sp3\\):*:*:*:*:*:*:*", "matchCriteriaId": "42AD7C07-1559-45F3-A364-1F9AB8D0B4E7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:huawei:osca-550x:-:*:*:*:*:*:*:*", "matchCriteriaId": "565AF527-86EF-4314-A645-B99D0C4C62C2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:hege-570_firmware:1.0.1.22\\(sp3\\):*:*:*:*:*:*:*", "matchCriteriaId": "D18EA69A-0C72-487C-92A3-9F622FAB2C51", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:huawei:hege-570:-:*:*:*:*:*:*:*", "matchCriteriaId": "35F5ADA7-C184-47D2-BD05-029162462E1A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Huawei HEGE-570 version 1.0.1.22(SP3); and HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X version 1.0.1.21(SP3) have an insufficient verification vulnerability. An attacker can access the device physically and exploit this vulnerability to tamper with device information. Successful exploit may cause service abnormal."}, {"lang": "es", "value": "Huawei HEGE-570 versi\u00f3n 1.0.1.22(SP3); y HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX y OSCA-550X versi\u00f3n 1.0.1.21(SP3), presentan una vulnerabilidad de comprobaci\u00f3n insuficiente. Un atacante puede acceder al dispositivo f\u00edsicamente y explotar esta vulnerabilidad para da\u00f1ar la informaci\u00f3n del dispositivo. Una explotaci\u00f3n con \u00e9xito puede causar un servicio anormal."}], "id": "CVE-2020-1855", "lastModified": "2021-07-21T11:39:23.747", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 3.6, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-02-18T03:15:11.277", "references": [{"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-03-osca-en"}], "sourceIdentifier": "psirt@huawei.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}