CVE-2019-5254

Vulnerability

An out-of-bounds read vulnerability exists in certain Huawei products: AP2000, IPS Module, NGFW Module, NIP6300, NIP6600, NIP6800, S5700, SVN5600, SVN5800, SVN5800-C, SeMG9811, Secospace AntiDDoS8000, Secospace USG6300, Secospace USG6500, Secospace USG6600, USG6000V, and eSpace U1981 [1]. The affected software versions are those prior to the fixes released in the security advisory [1]. The bug resides in the inter-process communication handling of the board; due to insufficient validation of incoming messages, a crafted packet can cause an out-of-bounds read condition.

Exploitation

An attacker must first log in to the board (i.e., have local or remote authenticated access) and then send crafted messages from the internal network port or tamper with inter-process message packets [1]. The attacker can control the content of those messages to trigger the out-of-bounds read.

Impact

Successful exploitation leads to abnormal behavior of the affected board [1]. The primary impact is a denial of service (the board becomes unstable or unavailable); information disclosure may also be possible due to the out-of-bounds read nature, though the advisory focuses on the board's abnormal state.

Mitigation

Huawei released security updates to fix this vulnerability in December 2019 [1]. Users should upgrade their affected products to the patched versions listed in the Huawei security advisory [1]. No workarounds are documented. The vulnerability is not listed on CISA’s Known Exploited Vulnerabilities catalog as of this writing.