CVE-2017-17329

Vulnerability

A memory leak vulnerability exists in Huawei ViewPoint 8660 running version V100R008C03. When parsing XML Schema data, the software fails to properly release allocated memory, leading to progressive memory consumption. An attacker with valid authentication can upload a specially crafted XML file to trigger the leak [1].

Exploitation

An authenticated attacker who can upload files to the device exploits this by providing a crafted XML file that triggers improper memory deallocation during XML Schema parsing. No user interaction beyond the attacker's own authentication is required. The attack does not require network position beyond the ability to reach the upload interface [1].

Impact

Successful exploitation causes the affected service to consume all available memory, leading to a denial of service condition. The impact is limited to service availability; no disclosure of data or code execution is indicated [1].

Mitigation

Huawei released a fixed version V100R008C03SPCc00 to resolve the issue. Customers should upgrade to this version as soon as possible. No workarounds were published. The vulnerability is not listed on CISA KEV [1].