CVE-2017-17301
Description
Huawei AR120-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, AR1200 V200R005C20, V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, AR1200-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, AR150 V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, AR160 V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, AR200 V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R008C20, AR200-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, AR2200 V200R005C20, V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, AR2200-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, AR3200 V200R005C32, V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20, V200R008C30, AR3600 V200R006C10, V200R007C00, V200R007C01, V200R008C20, AR510 V200R005C32, V200R006C10, V200R007C00, V200R008C20, CloudEngine 12800 V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00, V200R001C00, CloudEngine 5800 V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00, V200R001C00, CloudEngine 6800 V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00, V200R001C00, CloudEngine 7800 V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00, V200R001C00, DP300 V500R002C00, SMC2.0 V100R003C10, V100R005C00, V500R002C00, SRG1300 V200R005C32, V200R006C10, V200R007C00, V200R007C02, V200R008C20, SRG2300 V200R005C32, V200R006C10, V200R007C00, V200R007C02, V200R008C20, SRG3300 V200R005C32, V200R006C10, V200R007C00, V200R008C20, TE30 V100R001C10, TE60 V100R003C00, V500R002C00, VP9660 V200R001C02, V200R001C30, V500R002C00, ViewPoint 8660 V100R008C02, V100R008C03, eSpace IAD V300R002C01, eSpace U1981 V200R003C20, V200R003C30, eSpace USM V100R001C01, V300R001C00 have a weak cryptography vulnerability. Due to not properly some values in the certificates, an unauthenticated remote attacker could forges a specific RSA certificate and exploits the vulnerability to pass identity authentication and logs into the target device to obtain permissions configured for the specific user name.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| huawei ar120-s_firmware | v200r005c32, v200r006c10, v200r007c00, v200r008c20 | — |
| huawei ar1200_firmware | v200r005c20, v200r005c32, v200r006c10, v200r007c00, v200r007c01, v200r007c02, v200r008c20 | — |
| huawei ar1200-s_firmware | v200r005c32, v200r006c10, v200r007c00, v200r008c20 | — |
| huawei ar150_firmware | v200r006c10, v200r007c00, v200r007c01, v200r007c02, v200r008c20 | — |
| huawei ar160_firmware | v200r005c32, v200r006c10, v200r007c00, v200r007c01, v200r007c02, v200r008c20 | — |
| huawei ar200_firmware | v200r005c32, v200r006c10, v200r007c00, v200r007c01, v200r008c20 | — |
| huawei ar200-s_firmware | v200r005c32, v200r006c10, v200r007c00, v200r007c01, v200r008c20 | — |
| huawei ar2200_firmware | v200r005c20, v200r005c32, v200r006c10, v200r007c00, v200r007c01, v200r007c02, v200r008c20 | — |
| huawei ar2200-s_firmware | v200r005c32, v200r006c10, v200r007c00, v200r008c20 | — |
| huawei ar3200_firmware | v200r005c32, v200r006c10, v200r006c11, v200r007c00, v200r007c01, v200r007c02, v200r008c00, v200r008c10, v200r008c20, v200r008c30 | — |
| huawei ar3600_firmware | v200r006c10, v200r007c00, v200r007c01, v200r008c20 | — |
| huawei ar510_firmware | v200r005c32, v200r006c10, v200r007c00, v200r008c20 | — |
| huawei cloudengine_12800_firmware | v100r003c00, v100r003c10, v100r005c00, v100r005c10, v100r006c00, v200r001c00 | — |
| huawei cloudengine_5800_firmware | v100r003c00, v100r003c10, v100r005c00, v100r005c10, v100r006c00, v200r001c00 | — |
| huawei cloudengine_6800_firmware | v100r003c00, v100r003c10, v100r005c00, v100r005c10, v100r006c00, v200r001c00 | — |
| huawei cloudengine_7800_firmware | v100r003c00, v100r003c10, v100r005c00, v100r005c10, v100r006c00, v200r001c00 | — |
| huawei dp300_firmware | v500r002c00 | — |
| huawei smc2.0_firmware | v100r003c10, v100r005c00, v500r002c00 | — |
| huawei srg1300_firmware | v200r005c32, v200r006c10, v200r007c00, v200r007c02, v200r008c20 | — |
| huawei srg2300_firmware | v200r005c32, v200r006c10, v200r007c00, v200r007c02, v200r008c20 | — |
| huawei srg3300_firmware | v200r005c32, v200r006c10, v200r007c00, v200r008c20 | — |
| huawei te30_firmware | v100r001c10 | — |
| huawei te60_firmware | v100r003c00, v500r002c00 | — |
| huawei vp9660_firmware | v200r001c02, v200r001c30, v500r002c00 | — |
| huawei viewpoint_8660_firmware | v100r008c02, v100r008c03 | — |
| huawei espace_iad_firmware | v300r002c01 | — |
| huawei espace_u1981_firmware | v200r003c20, v200r003c30 | — |
| huawei espace_usm_firmware | v100r001c01, v300r001c00 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.