There is a buffer overflow vulnerability in some Huawei products. The vulnerability can be exploited by an attacker to perform remote code…

Description

There is a buffer overflow vulnerability in some Huawei products. The vulnerability can be exploited by an attacker to perform remote code execution on the affected products when the affected product functions as an optical line terminal (OLT). Affected product versions include:SmartAX MA5600T versions V800R013C10, V800R015C00, V800R015C10, V800R017C00, V800R017C10, V800R018C00, V800R018C10; SmartAX MA5800 versions V100R017C00, V100R017C10, V100R018C00, V100R018C10, V100R019C10; SmartAX EA5800 versions V100R018C00, V100R018C10, V100R019C10.

Scores

EPSS (exploitation in 30 days)

0.62% · top 50% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.0.

Weakness

• Buffer Overflow
• CWE-120 (opens in a new tab)All about CWE-120 and its CVEs

Affected products

• SmartAX MA5600T

  • affected V800R013C10
  • affected V800R015C00
  • affected V800R015C10
  • affected V800R017C00
  • affected V800R017C10
  • affected V800R018C00
  • affected V800R018C10

• SmartAX MA5800

  • affected V100R017C00
  • affected V100R017C10
  • affected V100R018C00
  • affected V100R018C10
  • affected V100R019C10

• SmartAX EA5800

  • affected V100R018C00
  • affected V100R018C10
  • affected V100R019C10

References (1)

• https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200401-01-overflow-en (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2020-9067](https://trackcve.app/badge/CVE-2020-9067.svg)](https://trackcve.app/cve/CVE-2020-9067)

Record last updated 4 Aug 2024, 10:19 UTC.