CVE-2020-9098 Null dereference in OceanStor 5310 V5
An attacker can cause a Huawei OceanStor storage device to reboot by sending a malformed packet that triggers an invalid pointer access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-9098?
CVE-2020-9098 is a high-severity vulnerability in OceanStor 5310 V5, published on 30 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Huawei OceanStor 5310 product with version of V500R007C60SPC100 has an invalid pointer access vulnerability. The software system access an invalid pointer when attacker malformed packet. Due to the insufficient validation of some parameter, successful exploit could cause device reboot.
Weakness: CWE-763
Which versions are affected by CVE-2020-9098?
It affects 1 product.
Products include Huawei Oceanstor 5310 Firmware.
How do I fix CVE-2020-9098?
No fix has been published for CVE-2020-9098 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-9098 being exploited?
There is no known exploitation of CVE-2020-9098 in the wild and no public exploit code.
Sources
Also known as GHSA-rcjj-gp97-vvv5.