A vulnerability was found in Huawei 576up005 HOTA-CM-H-Shark-BD, 577HOTA-CM-H-Shark-BD, 581up-HOTA-CM-H-Shark-BD, 586-HOTA-CM-H-Shark-BD, 588-HOTA-CM-H-Shark-BD, 606-HOTA-CM-H-Shark-BD, BI-ACC-REPORT and CM-H-Shark-BD (Reporting Software) and classified as critical. This issue affects some unknown processing of the component Headset Handler. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

There is an out-of-bounds read and write vulnerability in some headset products. An unauthenticated attacker gets the device physically and crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message, which may be exploited to cause out-of-bounds read and write.

The weakness was released 09/21/2022 as huawei-sa-20220826-01. The advisory is shared at huawei.com. The identification of this vulnerability is CVE-2020-36602 since 08/25/2022. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/21/2022).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Type

• Reporting Software

Vendor

• Huawei

Name

• 576up005 HOTA-CM-H-Shark-BD
• 577HOTA-CM-H-Shark-BD
• 581up-HOTA-CM-H-Shark-BD
• 586-HOTA-CM-H-Shark-BD
• 588-HOTA-CM-H-Shark-BD
• 606-HOTA-CM-H-Shark-BD
• BI-ACC-REPORT
• CM-H-Shark-BD

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion