5.5med
CVE-2017-17148
Huawei DP300 V500R002C00 have a DoS vulnerability due to the lack of validation when the malloc is called.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
5.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.2%
percentile 9%
Public exploits
0
none known
Summary
Huawei DP300 V500R002C00 have a DoS vulnerability due to the lack of validation when the malloc is called. An authenticated local attacker can craft specific XML files to the affected products and parse this file, which result in DoS attacks.
Exploit prediction (EPSS)
0.19% probability of exploitation in the next 30 days, higher than 9% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.9 | AV:L/AC:L/Au:N/C:N/I:N/A:C |
Affected products
- Huawei Technologies Co., Ltd. DP300
Classification
- Weakness
- CWE-20 Improper Input Validation
References
- huawei.com /en/psirt/security-advisories/huawei-sa-20171215-01-xml-en · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-17148
- NVD: CVE-2017-17148
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.