CVE-2020-1821 Memory corruption in IPS Module
Out-of-bounds read in Huawei network devices allows attackers to disrupt service via malicious packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-1821?
CVE-2020-1821 is a low-severity memory corruption vulnerability in Huawei Ips Module Firmware, published on 28 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some Huawei products. The specific decoding function may occur out-of-bounds read when processes an incoming data packet. Successful exploit of these vulnerabilities may disrupt service on the affected device. (Vulnerability ID: HWPSIRT-2018-12275,HWPSIRT-2018-12276,HWPSIRT-2018-12277,HWPSIRT-2018-12278,HWPSIRT-2018-12279,HWPSIRT-2018-12280 and HWPSIRT-2018-12289)
The seven vulnerabilities have been assigned seven Common Vulnerabilities and Exposures (CVE) IDs: CVE-2020-1818, CVE-2020-1819, CVE-2020-1820, CVE-2020-1821, CVE-2020-1822, CVE-2020-1823 and CVE-2020-1824.
Weakness: CWE-125
Which versions are affected by CVE-2020-1821?
It affects 9 products.
Products include Huawei Ips Module Firmware, Huawei Ngfw Module Firmware, Huawei Nip6300 Firmware, Huawei Nip6600 Firmware, Huawei Nip6800 Firmware, Huawei Secospace Usg6300 Firmware and 3 more.
How do I fix CVE-2020-1821?
No fix has been published for CVE-2020-1821 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-1821 being exploited?
There is no known exploitation of CVE-2020-1821 in the wild and no public exploit code.
Other vulnerabilities in Huawei Ips Module Firmware
- CVE-2020-9099 Auth bypass in IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospace USG6300; Secospace USG6500; Secospace USG6600; USG9500
- CVE-2016-4576 Memory corruption in n/a
- CVE-2021-37129 Memory corruption in IIPS Module;NGFW Module;NIP6600;S12700;S1700;S2700;S5700;S6700;S7700;S9700;USG9500
- CVE-2021-22320 Denial of service in IPS Module;NGFW Module;NIP6600;NIP6800;Secospace USG6300;Secospace USG6500;Secospace USG6600
- CVE-2017-15348 Denial of service in IPS Module,NGFW Module,NIP6300,NIP6600,Secospace USG6300,Secospace USG6500,Secospace USG6600,USG9500,
Sources
Also known as GHSA-866j-7c9v-5xf7.