CVE-2019-5259 Information disclosure in AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;AR2200;AR2200-S;AR3200;AR3600

Medium 6.5 Published 16 Dec 2019 Updated 4 Aug 2024

Low-privilege attackers can view high-privilege information on Huawei AR routers by running specific commands, leading to information disclosure.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-5259?

CVE-2019-5259 is a medium-severity vulnerability in Huawei Ar3200 Firmware, published on 16 Dec 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

There is an information leakage vulnerability on some Huawei products(AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;AR2200;AR2200-S;AR3200;AR3600). An attacker with low permissions can view some high-privilege information by running specific commands.Successful exploit could cause an information disclosure condition.

Weakness: CWE-269

Which versions are affected by CVE-2019-5259?

It affects 12 products.

Products include Huawei Ar120-S Firmware, Huawei Ar1200-S Firmware, Huawei Ar1200 Firmware, Huawei Ar150-S Firmware, Huawei Ar150 Firmware, Huawei Ar160 Firmware and 6 more.

How do I fix CVE-2019-5259?

No fix has been published for CVE-2019-5259 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-5259 being exploited?

There is no known exploitation of CVE-2019-5259 in the wild and no public exploit code.

All Huawei Ar3200 Firmware vulnerabilities

Sources

Also known as GHSA-g3x5-hj34-q968.