CVE-2017-15317

AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30; AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30; AR1200-S V200R006C10, V200R007C00, V200R008C20, V200R008C30; AR150 V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30; AR150-S V200R006C10, V200R007C00, V200R008C20, V200R008C30; AR160 V200R006C10, V200R006C12, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30; AR200 V200R006C10, V200R007C00, V200R007C01, V200R008C20, V200R008C30; AR200-S V200R006C10, V200R007C00, V200R008C20, V200R008C30; AR2200 V200R006C10, V200R006C13, V200R006C16, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30; AR2200-S V200R006C10, V200R007C00, V200R008C20, V200R008C30; AR3200 V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20, V200R008C30; AR510 V200R006C10, V200R006C12, V200R006C13, V200R006C15, V200R006C16, V200R006C17, V200R007C00, V200R008C20, V200R008C30; SRG1300 V200R006C10, V200R007C00, V200R007C02, V200R008C20, V200R008C30; SRG2300 V200R006C10, V200R007C00, V200R007C02, V200R008C20, V200R008C30; SRG3300 V200R006C10, V200R007C00, V200R008C20, V200R008C30 have an input validation vulnerability in Huawei multiple products. Due to the insufficient input validation, an unauthenticated, remote attacker may craft a malformed Stream Control Transmission Protocol (SCTP) packet and send it to the device, causing the device to read out of bounds and restart.

Score

CVSS 3.0 7.5 High

Status

Modified - psirt@huawei.com

Published

2017-12-22

Last modified

2024-09-17

Weaknesses

CWE-125

Affected products

• Ar120-s Firmware (Huawei)
• Ar1200-s Firmware (Huawei)
• Ar1200 Firmware (Huawei)
• Ar150-s Firmware (Huawei)
• Ar150 Firmware (Huawei)
• Ar160 Firmware (Huawei)
• Ar200-s Firmware (Huawei)
• Ar200 Firmware (Huawei)
• Ar2200-s Firmware (Huawei)
• Ar2200 Firmware (Huawei)
• Ar3200 Firmware (Huawei)
• Ar510 Firmware (Huawei)
• Srg1300 Firmware (Huawei)
• Srg2300 Firmware (Huawei)
• Srg3300 Firmware (Huawei)
• Ar120-s (Huawei Technologies Co. Ltd.)
• Ar1200 (Huawei Technologies Co. Ltd.)
• Ar1200-s (Huawei Technologies Co. Ltd.)
• Ar150 (Huawei Technologies Co. Ltd.)
• Ar150-s (Huawei Technologies Co. Ltd.)
• Ar160 (Huawei Technologies Co. Ltd.)
• Ar200 (Huawei Technologies Co. Ltd.)
• Ar200-s (Huawei Technologies Co. Ltd.)
• Ar2200 (Huawei Technologies Co. Ltd.)
• Ar2200-s (Huawei Technologies Co. Ltd.)
• Ar3200 (Huawei Technologies Co. Ltd.)
• Ar510 (Huawei Technologies Co. Ltd.)
• Srg1300 (Huawei Technologies Co. Ltd.)
• Srg2300 (Huawei Technologies Co. Ltd.)
• Srg3300 (Huawei Technologies Co. Ltd.)

References

• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171206-01-sctp-en