CVE-2017-17303 in DP300
Summary
by MITRE
Huawei DP300 V500R002C00; V500R002C00B010; V500R002C00B011; V500R002C00B012; V500R002C00B013; V500R002C00B014; V500R002C00B017; V500R002C00B018; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC400; V500R002C00SPC500; V500R002C00SPC600; V500R002C00SPC800; V500R002C00SPC900; V500R002C00SPCa00; RP200 V500R002C00SPC200; V600R006C00; V600R006C00SPC200; V600R006C00SPC300; TE30 V100R001C10SPC300; V100R001C10SPC500; V100R001C10SPC600; V100R001C10SPC700B010; V500R002C00SPC200; V500R002C00SPC500; V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC900; V500R002C00SPCb00; V600R006C00; V600R006C00SPC200; V600R006C00SPC300; TE40 V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC900; V500R002C00SPCb00; V600R006C00; V600R006C00SPC200; V600R006C00SPC300; TE50 V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPCb00; V600R006C00; V600R006C00SPC200; V600R006C00SPC300; TE60 V100R001C10; V100R001C10B001; V100R001C10B002; V100R001C10B010; V100R001C10B011; V100R001C10B012; V100R001C10B013; V100R001C10B014; V100R001C10B016; V100R001C10B017; V100R001C10B018; V100R001C10B019; V100R001C10SPC400; V100R001C10SPC500; V100R001C10SPC600; V100R001C10SPC700; V100R001C10SPC800B011; V100R001C10SPC900; V500R002C00; V500R002C00B010; V500R002C00B011; V500R002C00SPC100; V500R002C00SPC200; V500R002C00SPC300; V500R002C00SPC600; V500R002C00SPC700; V500R002C00SPC800; V500R002C00SPC900; V500R002C00SPCa00; V500R002C00SPCb00; V500R002C00SPCd00; V500R002C00SPCe00; V600R006C00; V600R006C00SPC100; V600R006C00SPC200; V600R006C00SPC300 use the CIDAM protocol, which contains sensitive information in the message when it is implemented. So these products has an information disclosure vulnerability. An authenticated remote attacker could track and get the message of a target system. Successful exploit could allow the attacker to get the information and cause the sensitive information disclosure.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 02/21/2023
The vulnerability identified as CVE-2017-17303 affects Huawei DP300 video conferencing devices and various other Huawei telepresence and video conferencing systems running multiple software versions. This represents a significant information disclosure flaw that operates at the protocol level, specifically within the CIDAM (Cisco Integrated Device Access Manager) protocol implementation used by these devices. The vulnerability stems from insufficient protection mechanisms that fail to adequately secure sensitive data transmitted through the CIDAM protocol, creating a pathway for unauthorized information extraction.
The technical flaw manifests in how the CIDAM protocol handles message transmission and encryption within Huawei's telepresence and video conferencing infrastructure. When these devices implement the CIDAM protocol, they transmit sensitive information within their message structures without proper obfuscation or encryption mechanisms. This design oversight allows authenticated remote attackers to intercept and analyze the transmitted data streams, potentially extracting confidential information from the target systems. The vulnerability specifically affects devices that utilize the CIDAM protocol, which is commonly implemented in enterprise-grade video conferencing and telepresence solutions where security is paramount.
From an operational impact perspective, this vulnerability creates serious security implications for organizations utilizing affected Huawei devices. The information disclosure risk extends beyond simple data exposure, as successful exploitation could enable attackers to track system activities and gather intelligence about network configurations, user activities, and potentially sensitive operational data. The authenticated nature of the attack means that an attacker would need valid credentials to exploit the vulnerability, but once achieved, the information disclosure could provide significant intelligence for further attacks. This vulnerability particularly affects enterprise environments where video conferencing systems are integral to business operations and contain sensitive communication data.
The security implications of this vulnerability align with CWE-200 (Information Exposure) and can be mapped to ATT&CK technique T1071.004 (Application Layer Protocol: DNS) and T1041 (Exfiltration Over C2 Channel) when considering how information might be extracted through the compromised protocol. Organizations should implement immediate mitigations including network segmentation to limit access to affected devices, enforcing strong authentication mechanisms, and monitoring network traffic for unusual patterns that might indicate exploitation attempts. Additionally, applying the latest firmware updates from Huawei to address this specific information disclosure vulnerability is crucial, as the vendor would have implemented proper encryption and message protection mechanisms to prevent unauthorized access to sensitive data within the CIDAM protocol communications.