Details of VAR-202006-1879

ID

VAR-202006-1879

CVE

CVE-2020-1824

TITLE

plural Huawei Product out-of-bounds read vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2024-016615

DESCRIPTION

There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some Huawei products. The specific decoding function may occur out-of-bounds read when processes an incoming data packet. Successful exploit of these vulnerabilities may disrupt service on the affected device. (Vulnerability ID: HWPSIRT-2018-12275,HWPSIRT-2018-12276,HWPSIRT-2018-12277,HWPSIRT-2018-12278,HWPSIRT-2018-12279,HWPSIRT-2018-12280 and HWPSIRT-2018-12289) The seven vulnerabilities have been assigned seven Common Vulnerabilities and Exposures (CVE) IDs: CVE-2020-1818, CVE-2020-1819, CVE-2020-1820, CVE-2020-1821, CVE-2020-1822, CVE-2020-1823 and CVE-2020-1824. IPS Module firmware, NGFW Module firmware, NIP6300 firmware etc. Huawei The product contains an out-of-bounds read vulnerability.Service operation interruption (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2020-1824 // JVNDB: JVNDB-2024-016615

AFFECTED PRODUCTS

vendor:	huawei	model:	nip6300	scope:	eq	version:	v500r005c00	Trust: 1.0
vendor:	huawei	model:	nip6300	scope:	eq	version:	v500r001c60	Trust: 1.0
vendor:	huawei	model:	secospace usg6300	scope:	eq	version:	v500r001c30	Trust: 1.0
vendor:	huawei	model:	ips module	scope:	eq	version:	v500r001c30	Trust: 1.0
vendor:	huawei	model:	secospace usg6500	scope:	eq	version:	v500r005c00	Trust: 1.0
vendor:	huawei	model:	secospace usg6500	scope:	eq	version:	v500r001c60	Trust: 1.0
vendor:	huawei	model:	usg6000v	scope:	eq	version:	v500r003c00	Trust: 1.0
vendor:	huawei	model:	nip6300	scope:	eq	version:	v500r001c30	Trust: 1.0
vendor:	huawei	model:	secospace usg6300	scope:	eq	version:	v500r005c00	Trust: 1.0
vendor:	huawei	model:	secospace usg6300	scope:	eq	version:	v500r001c60	Trust: 1.0
vendor:	huawei	model:	secospace usg6600	scope:	eq	version:	v500r001c30	Trust: 1.0
vendor:	huawei	model:	ips module	scope:	eq	version:	v500r005c00	Trust: 1.0
vendor:	huawei	model:	ips module	scope:	eq	version:	v500r001c60	Trust: 1.0
vendor:	huawei	model:	nip6800	scope:	eq	version:	v500r005c00	Trust: 1.0
vendor:	huawei	model:	nip6800	scope:	eq	version:	v500r001c60	Trust: 1.0
vendor:	huawei	model:	secospace usg6600	scope:	eq	version:	v500r005c00	Trust: 1.0
vendor:	huawei	model:	ngfw module	scope:	eq	version:	v500r005c00	Trust: 1.0
vendor:	huawei	model:	nip6600	scope:	eq	version:	v500r001c30	Trust: 1.0
vendor:	huawei	model:	ngfw module	scope:	eq	version:	v500r002c20	Trust: 1.0
vendor:	huawei	model:	nip6600	scope:	eq	version:	v500r005c00	Trust: 1.0
vendor:	huawei	model:	nip6600	scope:	eq	version:	v500r001c60	Trust: 1.0
vendor:	huawei	model:	ngfw module	scope:	eq	version:	v500r002c00	Trust: 1.0
vendor:	huawei	model:	secospace usg6500	scope:	eq	version:	v500r001c30	Trust: 1.0
vendor:	huawei	model:	secospace usg6500	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	usg6000v	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	nip6600	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	nip6300	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	nip6800	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	ips module	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	secospace usg6600	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	ngfw module	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	secospace usg6300	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2024-016615 // NVD: CVE-2020-1824

CVSS

SEVERITY

CVSSV2

CVSSV3

psirt@huawei.com:	CVE-2020-1824
value:	LOW
Trust: 1.0
nvd@nist.gov:	CVE-2020-1824
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2020-1824
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202006-1903
value:	LOW
Trust: 0.6

psirt@huawei.com:	CVE-2020-1824
baseSeverity:	LOW
baseScore:	3.7
vectorString:	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	2.2
impactScore:	1.4
version:	3.1
Trust: 1.0
nvd@nist.gov:	CVE-2020-1824
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.1
Trust: 1.0
NVD:	CVE-2020-1824
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2024-016615 // CNNVD: CNNVD-202006-1903 // NVD: CVE-2020-1824 // NVD: CVE-2020-1824

PROBLEMTYPE DATA

problemtype:	CWE-125	Trust: 1.0
problemtype:	Out-of-bounds read (CWE-125) [ others ]	Trust: 0.8
problemtype:	Out-of-bounds read (CWE-125) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-016615 // NVD: CVE-2020-1824

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202006-1903

PATCH

title:

Huawei product security vulnerabilities repair measures

url:

http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=126994

Trust: 0.6

sources: CNNVD: CNNVD-202006-1903

EXTERNAL IDS

db:	NVD	id:	CVE-2020-1824	Trust: 3.2
db:	JVNDB	id:	JVNDB-2024-016615	Trust: 0.8
db:	CNNVD	id:	CNNVD-202006-1903	Trust: 0.6

sources: JVNDB: JVNDB-2024-016615 // CNNVD: CNNVD-202006-1903 // NVD: CVE-2020-1824

REFERENCES

url:	https://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20191218-01-cops-en	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2020-1824	Trust: 0.8
url:	https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20191218-01-cops-cn	Trust: 0.6

sources: JVNDB: JVNDB-2024-016615 // CNNVD: CNNVD-202006-1903 // NVD: CVE-2020-1824

SOURCES

db:	JVNDB	id:	JVNDB-2024-016615
db:	CNNVD	id:	CNNVD-202006-1903
db:	NVD	id:	CVE-2020-1824

LAST UPDATE DATE

2025-01-18T23:07:11.580000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2024-016615	date:	2025-01-16T07:10:00
db:	CNNVD	id:	CNNVD-202006-1903	date:	2021-01-05T00:00:00
db:	NVD	id:	CVE-2020-1824	date:	2025-01-13T18:39:27.433

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2024-016615	date:	2025-01-16T00:00:00
db:	CNNVD	id:	CNNVD-202006-1903	date:	2020-06-03T00:00:00
db:	NVD	id:	CVE-2020-1824	date:	2024-12-28T07:15:18.530