Some Huawei products have an insufficient verification of data authenticity vulnerability. A remote, unauthenticated attacker has to…

Description

Some Huawei products have an insufficient verification of data authenticity vulnerability. A remote, unauthenticated attacker has to intercept specific packets between two devices, modify the packets, and send the modified packets to the peer device. Due to insufficient verification of some fields in the packets, an attacker may exploit the vulnerability to cause the target device to be abnormal.

Scores

EPSS (exploitation in 30 days)

0.36% · top 70% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Weakness

• Insufficient Verification
• CWE-345 (opens in a new tab)All about CWE-345 and its CVEs

Affected products

• AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;AR2200;AR2200-S;AR3200;AR3600;CloudEngine 12800;NetEngine16EX;S6700;SRG1300;SRG2300;SRG3300

  • affected V200R005C20
  • affected V200R006C10
  • affected V200R007C00
  • affected V200R008C50
  • affected V200R005C00
  • affected V200R002C10
  • affected V200R002C20
  • affected V200R008C00
  • affected V200R010C00SPC300
  • affected V200R010C00SPC600
  • affected V200R011C00SPC200

References (1)

• http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20191204-01-validation-en (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-5291](https://trackcve.app/badge/CVE-2019-5291.svg)](https://trackcve.app/cve/CVE-2019-5291)

Record last updated 4 Aug 2024, 19:54 UTC.