CVE-2020-1821

Vulnerability

Multiple out-of-bounds (OOB) read vulnerabilities exist in the implementation of the Common Open Policy Service (COPS) protocol of some Huawei products. The specific decoding function performs an out-of-bounds read when processing an incoming data packet. Affected products and versions include IPS Module V500R001C30, V500R001C60, V500R005C00, and others as listed in the advisory [1].

Exploitation

An attacker must send a crafted COPS data packet to the affected device. No authentication or special network position beyond the ability to deliver a malformed packet to the COPS decoding function is required [1].

Impact

Successful exploitation causes a denial of service by disrupting service on the affected device [1].

Mitigation

Huawei has released software updates to fix these vulnerabilities. For IPS Module, the resolved version is V500R005C20SPC500. Users should upgrade to the fixed versions as indicated in the security advisory [1].