CVE-2017-17187

Vulnerability

An integer overflow vulnerability exists in Huawei products DP300, RP200, TE30, TE40, TE50, and TE60 across multiple firmware versions as specified in V500R002C00, V100R001C10, V600R006C00, V500R002C00 and V600R006C00 [1]. Due to insufficient input validation, an authenticated remote attacker can send specially crafted SOAP packets to the target device, triggering an integer overflow that may reset a process [1].

Exploitation

An attacker must first gain authenticated access to the target device over the network. Once authenticated, the attacker sends malformed SOAP packets designed to exploit the integer overflow condition [1]. The attack requires no additional privileges beyond the initial authentication and no user interaction on the target device.

Impact

Successful exploitation of the integer overflow can cause a process to reset. This constitutes a denial-of-service condition, as the affected process may terminate and need to be restarted [1]. The vulnerability does not appear to allow arbitrary code execution or privilege escalation based on the available information.

Mitigation

Huawei has released software updates addressing this vulnerability as of February 7, 2018 [1]. Users should upgrade their affected products to the latest firmware versions provided in the vendor security advisory. No workarounds are documented; the recommended action is to apply the official patches.