CVE-2017-17310

Vulnerability

A buffer error vulnerability exists in the Electronic Numbers to URI Mapping (ENUM) module of several Huawei products, including DP300 V500R002C00, RP200 V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00, TE50 V500R002C00, V600R006C00, and TE60 V100R001C10, V500R002C00, V600R006C00 [1]. The vulnerability arises due to insufficient verification of certain values in specially crafted ENUM packets, leading to a buffer error [1].

Exploitation

An unauthenticated, remote attacker must control the peer device and send specially crafted ENUM packets to the affected products [1]. No authentication or user interaction is required, and the attacker can trigger the vulnerability over the network by exploiting the insufficient verification of packet values [1].

Impact

Successful exploitation causes a buffer error, resulting in abnormal behavior of some services on the affected device [1]. The impact is limited to service disruption; no code execution or privilege escalation is described in the available references.

Mitigation

Huawei has released software updates to fix this vulnerability [1]. The resolved versions are: DP300 V500R002C00SPCb00, RP200 TEX0 V600R006C00SPC500, and for TE30 an upgrade to TEX0 V600R006C00SPC500 (and similar updates for other models) [1]. Users should apply the updates from Huawei's official support channels. No workarounds are documented, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.