CVE-2017-17219

Vulnerability

The SCCPX module in multiple Huawei video conferencing products contains an invalid memory access vulnerability (CVE-2017-17219). Affected products and versions include: DP300 V500R002C00; RP200 V500R002C00, V600R006C00; TE30 V100R001C10, V500R002C00, V600R006C00; TE40 V500R002C00, V600R006C00; TE50 V500R002C00, V600R006C00; TE60 V100R001C10, V500R002C00, V600R006C00. An unauthenticated, remote attacker can send malformed packets with a specific parameter to the affected products. Due to insufficient validation of the packets, memory access errors occur [1].

Exploitation

An attacker does not require authentication or prior access to the network segment. The attack vector is remote, sending crafted packets with a specific parameter to the target device's SCCPX module. No user interaction is needed. The exploitation involves sending malformed packets that cause invalid memory access due to insufficient input validation [1].

Impact

Successful exploitation impacts the availability of the product service. The vulnerability leads to a denial of service (DoS) condition, potentially causing the affected device to crash or become unresponsive [1].

Mitigation

Huawei has released software updates to fix these vulnerabilities. The resolved product versions are listed in the security advisory available at [1]. Users should upgrade their affected products to the fixed versions as specified by Huawei. There is no workaround mentioned; applying the patch is the recommended mitigation [1].