CVE-2017-17218

Vulnerability

An out-of-bounds read vulnerability exists in the SCCPX module of multiple Huawei video conferencing products, including DP300 V500R002C00, RP200 V500R002C00 and V600R006C00, TE30 V100R001C10, V500R002C00, and V600R006C00, TE40 V500R002C00 and V600R006C00, TE50 V500R002C00 and V600R006C00, and TE60 V100R001C10, V500R002C00, and V600R006C00 [1]. The vulnerability is due to insufficient validation of malformed packets with specific parameters sent to the SCCPX module [1].

Exploitation

An unauthenticated, remote attacker can exploit this vulnerability by crafting and sending malformed packets with a specific parameter to an affected product [1]. No authentication or user interaction is required; the attacker only needs network access to the target device [1].

Impact

Successful exploitation of the out-of-bounds read may impact the availability of the product service, leading to a denial-of-service condition [1]. The vulnerability does not appear to allow arbitrary code execution or privilege escalation based on available documentation [1].

Mitigation

Huawei has released software updates to fix this vulnerability; affected users should update to the resolved product versions listed in the security advisory [1]. The advisory recommends upgrading to the specific fixed versions for each product model as provided in the reference [1].