CVE-2014-4705 Memory corruption in n/a

High 7.5 Published 30 Jan 2018 Updated 6 Aug 2024

Remote attackers can cause a denial of service via crafted packets exploiting heap-based buffer overflows in Huawei network devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2014-4705?

CVE-2014-4705 is a high-severity memory corruption vulnerability in Huawei Ar3200 Firmware, published on 30 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Multiple heap-based buffer overflows in the eSap software platform in Huawei Campus S9300, S7700, S9700, S5300, S5700, S6300, and S6700 series switches; AR150, AR160, AR200, AR1200, AR2200, AR3200, AR530, NetEngine16EX, SRG1300, SRG2300, and SRG3300 series routers; and WLAN AC6005, AC6605, and ACU2 access controllers allow remote attackers to cause a denial of service (device restart) via a crafted length field in a packet.

Weakness: CWE-119

Which versions are affected by CVE-2014-4705?

It affects 21 products.

Products include Huawei Ar1200 Firmware, Huawei Ar150 Firmware, Huawei Ar160 Firmware, Huawei Ar200 Firmware, Huawei Ar2200 Firmware, Huawei Ar3200 Firmware and 15 more.

How do I fix CVE-2014-4705?

No fix has been published for CVE-2014-4705 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2014-4705 being exploited?

There is no known exploitation of CVE-2014-4705 in the wild and no public exploit code.

All Huawei Ar3200 Firmware vulnerabilities

Sources

Also known as GHSA-7vcf-r2g3-43c4.