CVE-2019-5268 Path traversal in CD10-10, CD16-10, CD17-10, CD18-10, HiRouter-CD15-10, HiRouter-CD20-10, HiRouter-CD21-16, HiRouter-CD30-10, HiRouter-CD30-11, HiRouter-H1-10, TC5200-10, WS5100-10, WS5102-10, WS5106-10, WS5108-10, WS5200-10, WS5200-11, , WS5280-10, WS5280-11, WS6500-10, WS6500-11, WS826-10
Attackers can read and upload files on Huawei home routers due to improper input validation, potentially compromising device integrity and data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-5268?
CVE-2019-5268 is a high-severity path traversal vulnerability in CD10-10, CD16-10, CD17-10, CD18-10, HiRouter-CD15-10, HiRouter-CD20-10, HiRouter-CD21-16, HiRouter-CD30-10, HiRouter-CD30-11, HiRouter-H1-10, TC5200-10, WS5100-10, WS5102-10, WS5106-10, WS5108-10, WS5200-10, WS5200-11, , WS5280-10, WS5280-11, WS6500-10, WS6500-11, WS826-10, published on 29 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Some Huawei home routers have an input validation vulnerability. Due to input parameter is not correctly verified, an attacker can exploit this vulnerability by sending special constructed packets to obtain files in the device and upload files to some directories.
Weakness: CWE-20
Which versions are affected by CVE-2019-5268?
It affects 22 products.
Products include Huawei Cd10-10 Firmware, Huawei Cd16-10 Firmware, Huawei Cd17-10 Firmware, Huawei Cd18-10 Firmware, Huawei Hirouter-Cd15-10 Firmware, Huawei Hirouter-Cd20-10 Firmware and 16 more.
How do I fix CVE-2019-5268?
No fix has been published for CVE-2019-5268 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-5268 being exploited?
There is no known exploitation of CVE-2019-5268 in the wild and no public exploit code.
Other vulnerabilities in CD10-10, CD16-10, CD17-10, CD18-10, HiRouter-CD15-10, HiRouter-CD20-10, HiRouter-CD21-16, HiRouter-CD30-10, HiRouter-CD30-11, HiRouter-H1-10, TC5200-10, WS5100-10, WS5102-10, WS5106-10, WS5108-10, WS5200-10, WS5200-11, , WS5280-10, WS5280-11, WS6500-10, WS6500-11, WS826-10
Sources
Also known as GHSA-2wp7-476w-v7fh.