Skip to main content

Ar3200 Firmware CVE-2019-5294

HIGH
Out-of-bounds Read (CWE-125)
2019-11-13 psirt@huawei.com
Buffer Overflow Information Disclosure Huawei Ar3200 Firmware Ar200 Firmware Ar1200 Firmware Ar2200 Firmware Ar120 S Firmware Ar1200 S Firmware Ar150 Firmware Ar150 S Firmware Ar160 Firmware Ar200 S Firmware Ar2200 S Firmware Netengine16Ex Firmware Srg1300 Firmware Srg2300 Firmware Srg3300 Firmware Ar3600 Firmware
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Nov 13, 2019 - 17:15 nvd
HIGH 7.5

DescriptionNVD

There is an out of bound read vulnerability in some Huawei products. A remote, unauthenticated attacker may send a corrupt or crafted message to the affected products. Due to a buffer read overflow error when parsing the message, successful exploit may cause some service to be abnormal.

AnalysisAI

There is an out of bound read vulnerability in some Huawei products. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Out-of-bounds Read (CWE-125), which allows attackers to read data from memory outside the intended buffer boundaries. There is an out of bound read vulnerability in some Huawei products. A remote, unauthenticated attacker may send a corrupt or crafted message to the affected products. Due to a buffer read overflow error when parsing the message, successful exploit may cause some service to be abnormal. Affected products include: Huawei Ar120-S Firmware, Huawei Ar1200 Firmware, Huawei Ar1200-S Firmware, Huawei Ar150 Firmware, Huawei Ar150-S Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate array indices and buffer lengths. Use memory-safe languages. Enable AddressSanitizer during testing.

More in Ar3200 Firmware

View all
CVE-2016-6206 CRITICAL
9.8 Mar 24

Huawei AR3200 routers with software before V200R007C00SPC600 allow remote attackers to cause a denial of service or exec
CVE-2020-9068 CRITICAL
9.8 Apr 27

Huawei AR3200 products with versions of V200R007C00SPC900, V200R007C00SPCa00, V200R007C00SPCb00, V200R007C00SPCc00, V200
CVE-2016-5368 HIGH
7.5 Jun 30

Memory leak in Huawei AR3200 before V200R007C00SPC900 allows remote attackers to cause a denial of service (memory consu
CVE-2016-8797 HIGH
7.5 Apr 02

Huawei AR3200 with software V200R007C00, V200R005C32, V200R005C20; S12700 with software V200R008C00, V200R007C00; S5300

CVE-2017-8147 HIGH
7.5 Nov 22

AC6005 V200R006C10SPC200,AC6605 V200R006C10SPC200,AR1200 with software V200R005C10CP0582T, V200R005C10HP0581T, V200R005C
CVE-2017-15317 HIGH
7.5 Dec 22

AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30; AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V
CVE-2018-7920 HIGH
7.5 Apr 19

Huawei AR1200 V200R006C10SPC300, AR160 V200R006C10SPC300, AR200 V200R006C10SPC300, AR2200 V200R006C10SPC300, AR3200 V200
CVE-2019-5300 MEDIUM
6.7 Jun 04

There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR2200-
CVE-2017-8162 MEDIUM
6.5 Nov 22

AR120-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR1200 with software V200R006C10, V200R006C13,

CVE-2017-8163 MEDIUM
6.5 Nov 22

AR120-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR1200 with software V200R006C10, V200R006C13,

CVE-2016-3950 MEDIUM
6.5 Apr 18

Huawei AR3200 routers with software before V200R006C10SPC300 allow remote authenticated users to cause a denial of servi
CVE-2020-9071 MEDIUM
6.5 Jun 01

There is a few bytes out-of-bounds read vulnerability in some Huawei products. Rated medium severity (CVSS 6.5), this vu

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Share

CVE-2019-5294 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy