A vulnerability classified as problematic was found in Huawei VP9660 V500R002C10. This vulnerability affects an unknown function of the component License Module. The manipulation with an unknown input leads to a format string vulnerability. The CWE definition for the vulnerability is CWE-134. The product uses a function that accepts a format string as an argument, but the format string originates from an external source. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Huawei VP9660 V500R002C10 has a uncontrolled format string vulnerability when the license module output the log information. An authenticated local attacker could exploit this vulnerability to cause a denial of service.

The bug was discovered 12/06/2017. The weakness was presented 03/05/2018 (Website). The advisory is available at huawei.com. This vulnerability was named CVE-2017-17132 since 12/04/2017. The exploitation appears to be easy. Local access is required to approach this attack. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 02/16/2023).

The vulnerability was handled as a non-public zero-day exploit for at least 89 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-114059 for similar entry. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Huawei

Name

• VP9660

Version

• V500R002C10

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion