CVE-2020-1860 Auth bypass in NIP6800;Secospace USG6600;USG9500
Attackers on the internal network can bypass access controls to directly access the Internet on Huawei NIP and USG devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-1860?
CVE-2020-1860 is a high-severity authentication bypass vulnerability in Huawei Nip6800 Firmware, published on 28 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an access control bypass vulnerability. Attackers that can access to the internal network can exploit this vulnerability with careful deployment. Successful exploit may cause the access control to be bypassed, and attackers can directly access the Internet.
Which versions are affected by CVE-2020-1860?
It affects 3 products.
Products include Huawei Nip6800 Firmware, Huawei Secospace Usg6600 Firmware, Huawei Usg9500 Firmware.
How do I fix CVE-2020-1860?
No fix has been published for CVE-2020-1860 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-1860 being exploited?
There is no known exploitation of CVE-2020-1860 in the wild and no public exploit code.
Other vulnerabilities in Huawei Nip6800 Firmware
Sources
Also known as GHSA-vcff-vwv3-4mf7.