CVE-2017-15356

Vulnerability

A buffer overflow vulnerability exists in multiple Huawei products, including DP300 (V500R002C00), RP200 (V600R006C00), TE30 (V100R001C10, V500R002C00, V600R006C00), TE40 (V500R002C00, V600R006C00), TE50 (V500R002C00, V600R006C00), TE60 (V100R001C10, V500R002C00, V600R006C00), and TX50 (V500R002C00, V600R006C00). The issue arises from insufficient input validation of three different parameters in specially crafted HTTP messages, as identified by Huawei vulnerability IDs HWPSIRT-2017-08063, HWPSIRT-2017-08064, and HWPSIRT-2017-08065 [1].

Exploitation

An attacker can exploit this vulnerability by sending specially crafted HTTP messages to affected devices. No authentication is mentioned as required for exploitation. The specific parameters that are improperly validated allow the attacker to trigger a buffer overflow condition through crafted input [1].

Impact

Successful exploitation may cause service abnormality, leading to disruption of the affected product's functionality. The vulnerability does not directly lead to code execution or data disclosure as described, but rather impacts availability by causing services to become abnormal or crash [1].

Mitigation

Huawei has released software updates to fix these vulnerabilities. For affected versions, the following resolved versions are available: DP300 V500R002C00SPCb00, RP200 V600R006C00SPC500, and other products upgrade to TEX0[1] V600R006C00SPC500 (as per advisory). Users should apply the updates via the Huawei support portal [1].