CVE-2020-1860 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an access control bypass vulnerability. Attackers that can access to the internal network can exploit this vulnerability with careful deployment. Successful exploit may cause the access control to be bypassed, and attackers can directly access the Internet.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Huawei	Nip6800 Firmware	v500r001c30
Huawei	Nip6800	-
Huawei	Secospace Usg6600 Firmware	v500r001c30
Huawei	Secospace Usg6600	-
Huawei	Usg9500 Firmware	v500r001c30
Huawei	Usg9500	-

References

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200219-02-firewaVendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200219-02-firewaVendor Advisory

FAQ

What is CVE-2020-1860?

CVE-2020-1860 is a vulnerability with a CVSS score of 7.5 (HIGH). NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an access control bypass vulnerability. Attackers that can access to the internal net...

How severe is CVE-2020-1860?

CVE-2020-1860 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-1860?

Check the references section above for vendor advisories and patch information. Affected products include: Huawei Nip6800 Firmware, Huawei Nip6800, Huawei Secospace Usg6600 Firmware, Huawei Secospace Usg6600, Huawei Usg9500 Firmware.