CVE-2017-17183

Vulnerability

An integer overflow vulnerability exists in Huawei DP300 V500R002C00, RP200 V500R002C00, V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, TE60 V100R001C10, V500R002C00, V600R006C00. Due to insufficient input validation, an authenticated, remote attacker can send malformed SOAP packets to the target device, triggering an integer overflow that may reset a process [1].

Exploitation

An attacker must have network access to the target device and valid authentication credentials. The attacker crafts and sends specially malformed SOAP packets to the device's SOAP interface. The device fails to properly validate the input, leading to an integer overflow condition [1].

Impact

Successful exploitation causes an integer overflow that can reset a process on the device, resulting in a denial of service (DoS). No further impact such as code execution or data disclosure is described in the available references [1].

Mitigation

Huawei has released software updates to fix this vulnerability. Users should upgrade to the latest firmware versions as indicated in the security advisory [1]. No workarounds are documented.