Some Huawei products have a buffer error vulnerability. An unauthenticated, remote attacker could send specific MPLS Echo Request messages…

Description

Some Huawei products have a buffer error vulnerability. An unauthenticated, remote attacker could send specific MPLS Echo Request messages to the target products. Due to insufficient input validation of some parameters in the messages, successful exploit may cause the device to reset.

Scores

EPSS (exploitation in 30 days)

0.97% · top 38% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• Buffer Error
• CWE-120 (opens in a new tab)All about CWE-120 and its CVEs

Affected products

• AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;AR200-S;AR2200;AR2200-S;AR3200;AR3600;IPS Module;NGFW Module;NIP6300;NIP6600;NetEngine16EX;S5700;S6700;SRG1300;SRG2300;SRG3300;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600

  • affected V200R006C10
  • affected V200R007C00
  • affected V200R008C20
  • affected V200R008C50
  • affected V200R003C01
  • affected V200R005C20
  • affected V500R001C20
  • affected V500R001C30
  • affected V500R002C00
  • affected V200R005C00
  • affected V200R005C02
  • affected V200R005C03
  • affected V200R006C00
  • affected V200R008C00
  • affected V200R010C00
  • affected V200R011C00
  • affected V200R005C01
  • affected V500R001C60
  • affected V500R005C00

References (1)

• https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200102-01-buffer-en (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-5304](https://trackcve.app/badge/CVE-2019-5304.svg)](https://trackcve.app/cve/CVE-2019-5304)

Record last updated 4 Aug 2024, 19:54 UTC.