CVE-2019-5258 Memory corruption in AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981
An authenticated attacker on the internal network can cause a denial of service on Huawei network devices by sending crafted messages that trigger a buffer overflow.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-5258?
CVE-2019-5258 is a medium-severity memory corruption vulnerability in Huawei Nip6300 Firmware, published on 13 Dec 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have a buffer overflow vulnerability. An attacker who logs in to the board may send crafted messages from the internal network port or tamper with inter-process message packets to exploit this vulnerability. Due to insufficient validation of the message, successful exploit may cause the affected board to be abnormal.
Weakness: CWE-120
Which versions are affected by CVE-2019-5258?
It affects 17 products.
Products include Huawei Ap2000 Firmware, Huawei Espace U1981 Firmware, Huawei Ips Firmware, Huawei Ngfw Firmware, Huawei Nip6300 Firmware, Huawei Nip6600 Firmware and 11 more.
How do I fix CVE-2019-5258?
No fix has been published for CVE-2019-5258 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-5258 being exploited?
There is no known exploitation of CVE-2019-5258 in the wild and no public exploit code.
Other vulnerabilities in Huawei Nip6300 Firmware
- CVE-2019-5254 Memory corruption in AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981
- CVE-2019-5255 Denial of service in AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981
- CVE-2019-5256 Null dereference in AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981
- CVE-2019-5257 Denial of service in AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981
Sources
Also known as GHSA-r58h-4phg-6hgx.