CVE-2020-9137 Privilege escalation in CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEngine 7800

Medium 6.7 Published 24 Dec 2020 Updated 4 Aug 2024

A local attacker with high privileges can execute crafted scripts to escalate privileges on Huawei CloudEngine switches.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-9137?

CVE-2020-9137 is a medium-severity vulnerability in CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEngine 7800, published on 24 Dec 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

There is a privilege escalation vulnerability in some versions of CloudEngine 12800,CloudEngine 5800,CloudEngine 6800 and CloudEngine 7800. Due to insufficient input validation, a local attacker with high privilege may execute some specially crafted scripts in the affected products. Successful exploit will cause privilege escalation.

Weakness: CWE-20

Which versions are affected by CVE-2020-9137?

It affects 4 products.

Products include Huawei Cloudengine 12800 Firmware, Huawei Cloudengine 5800 Firmware, Huawei Cloudengine 6800 Firmware, Huawei Cloudengine 7800 Firmware.

How do I fix CVE-2020-9137?

No fix has been published for CVE-2020-9137 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-9137 being exploited?

There is no known exploitation of CVE-2020-9137 in the wild and no public exploit code.

Sources

Also known as GHSA-2v2m-677r-5j24.