CVE-2017-15341 Denial of service in AR3200,TE40,TE50,TE60
Remote attackers can cause denial of service on Huawei network devices by sending crafted X.509 certificates due to improper decoding.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-15341?
CVE-2017-15341 is a high-severity denial of service vulnerability in Huawei Ar3200 Firmware, published on 15 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Huawei AR3200 V200R008C20, V200R008C30, TE40 V600R006C00, TE50 V600R006C00, TE60 V600R006C00 have a denial of service vulnerability. The software decodes X.509 certificate in an improper way. A remote unauthenticated attacker could send a crafted X.509 certificate to the device. Successful exploit could result in a denial of service on the device.
Weakness: CWE-295
Which versions are affected by CVE-2017-15341?
It affects 4 products.
Products include Huawei Ar3200 Firmware, Huawei Te40 Firmware, Huawei Te50 Firmware, Huawei Te60 Firmware.
How do I fix CVE-2017-15341?
No fix has been published for CVE-2017-15341 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-15341 being exploited?
There is no known exploitation of CVE-2017-15341 in the wild and no public exploit code.
Other vulnerabilities in Huawei Ar3200 Firmware
- CVE-2020-9068 Auth bypass in AR3200
- CVE-2016-6206 Other in n/a
- CVE-2016-8797 Denial of service in AR3200,S12700,S5300,S5700,S6300,S6700,S7700,S9300,S9700 AR3200 V200R007C00, V200R005C32, V200R005C20,S12700 V200R008C00, V200R007C00,S5300 V200R008C00, V200R007C00, V200R006C00,S5700 V200R008C00, V200R007C00, V200R006C00,S6300 V200R008C00, V200R007C00,S6700 V200R008C00, V200R007C00,S7700 V200R008C00, V200R007C00, V200R006C00,S9300 V200R008C00, V200R007C00, V200R006C00,S9700 V200R008C00, V200R007C00, V200R006C00,
- CVE-2016-5368 Denial of service in n/a
- CVE-2016-3950 Denial of service in n/a
Sources
Also known as GHSA-h698-9r6p-x6xw.