CVE-2020-9075 Path traversal in Secospace USG6300;USG6300E

Medium 6.5 Published 15 Jun 2020 Updated 4 Aug 2024

An attacker with limited privileges can exploit insufficient input verification to access specific directories, leading to information leakage on Huawei Secospace USG devices.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-9075?

CVE-2020-9075 is a medium-severity path traversal vulnerability in Huawei Secospace Usg6300 Firmware, published on 15 Jun 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Huawei products Secospace USG6300;USG6300E with versions of V500R001C30,V500R001C50,V500R001C60,V500R001C80,V500R005C00,V500R005C10;V600R006C00 have a vulnerability of insufficient input verification. An attacker with limited privilege can exploit this vulnerability to access a specific directory. Successful exploitation of this vulnerability may lead to information leakage.

Weakness: CWE-20

Which versions are affected by CVE-2020-9075?

It affects 3 products.

Products include Huawei Secospace Usg6300 Firmware, Huawei Secospace Usg6600 Firmware, Huawei Usg6300e Firmware.

How do I fix CVE-2020-9075?

No fix has been published for CVE-2020-9075 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2020-9075 being exploited?

There is no known exploitation of CVE-2020-9075 in the wild and no public exploit code.

All Huawei Secospace Usg6300 Firmware vulnerabilities

Sources

Also known as GHSA-j748-8wr5-mq8p.