Vulnerabilities > CVE-2020-1814 - NULL Pointer Dereference vulnerability in Huawei products

CVSS 3.5 - LOW

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

SINGLE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

PARTIAL

network

huawei

CWE-476

NVD

Published: 2020-02-18

Updated: 2021-07-21

Summary

Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a Dangling pointer dereference vulnerability. An authenticated attacker may do some special operations in the affected products in some special scenarios to exploit the vulnerability. Due to improper race conditions of different operations, successful exploit will lead to Dangling pointer dereference, causing some service abnormal.

Vulnerable Configurations

Part	Description	Count
OS	Huawei Huawei Nip6800 Firmware V500R001C30 Huawei Nip6800 Firmware V500R001C60Spc500 Huawei Nip6800 Firmware V500R005C00 Huawei Secospace Usg6600 Firmware V500R001C30Spc200 Huawei Secospace Usg6600 Firmware V500R001C30Spc600 Huawei Secospace Usg6600 Firmware V500R001C60Spc500 Huawei Secospace Usg6600 Firmware V500R005C00 Huawei Usg9500 Firmware V500R001C30Spc200 Huawei Usg9500 Firmware V500R001C30Spc600 Huawei Usg9500 Firmware V500R001C60Spc500 Huawei Usg9500 Firmware V500R005C00	11
Hardware	Huawei Huawei Nip6800 - Huawei Secospace Usg6600 - Huawei Usg9500 -	3

Common Weakness Enumeration (CWE)

CWE-476 - NULL Pointer Dereference

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200212-01-firewall-en