CVE-2017-17311 Denial of service in USG2205BSR; USG2220BSR; USG5120BSR; USG5150BSR

High 7.5 Published 21 Aug 2018 Updated 5 Aug 2024

Attackers can cause denial of service on Huawei USG firewalls by sending malformed IPSEC IKEv1 packets due to improper input handling.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-17311?

CVE-2017-17311 is a high-severity denial of service vulnerability in Huawei Technologies Co., Ltd. USG2205BSR; USG2220BSR; USG5120BSR; USG5150BSR, published on 21 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a DoS vulnerability in the IPSEC IKEv1 implementations of Huawei Firewall products. Due to improper handling of the malformed messages, an attacker may sent crafted packets to the affected device to exploit these vulnerabilities. Successful exploit the vulnerability could lead to device deny of service.

Weakness: CWE-20

Which versions are affected by CVE-2017-17311?

It affects 4 products.

Products include Huawei Usg2205bsr Firmware, Huawei Usg2220bsr Firmware, Huawei Usg5120bsr Firmware, Huawei Usg5150bsr Firmware.

How do I fix CVE-2017-17311?

No fix has been published for CVE-2017-17311 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2017-17311 being exploited?

There is no known exploitation of CVE-2017-17311 in the wild and no public exploit code.

Sources

Also known as GHSA-m3wg-6jv7-pjg8.