CVE-2019-5298

There is an improper authentication vulnerability in some Huawei AP products before version V200R009C00SPC800. Due to the improper implementation of authentication for the serial port, an attacker could exploit this vulnerability by connecting to the affected products and running a series of commands.

CVSS v3 6.8 MEDIUM
CVSS v2.0 4.6 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector : AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190327-01-ap-en	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:huawei:ap4050dn-e_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:huawei:ap4050dn-e:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-06-04 19:29

Updated : 2019-06-05 18:21

NVD link : CVE-2019-5298

Mitre link : CVE-2019-5298

CVE.ORG link : CVE-2019-5298

JSON object : View

Products Affected

huawei

ap4050dn-e_firmware
ap4050dn-e

CWE

CWE-287

Improper Authentication

{"id": "CVE-2019-5298", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "published": "2019-06-04T19:29:00.587", "references": [{"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190327-01-ap-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "There is an improper authentication vulnerability in some Huawei AP products before version V200R009C00SPC800. Due to the improper implementation of authentication for the serial port, an attacker could exploit this vulnerability by connecting to the affected products and running a series of commands."}, {"lang": "es", "value": "Existe una vulnerabilidad de identificaci\u00f3n incorrecta en algunos productos de Huawei AP antes de la versi\u00f3n V200R009C00SPC800. Debido a la implementaci\u00f3n incorrecta de la identificaci\u00f3n para el puerto serie, un atacante podr\u00eda aprovechar esta vulnerabilidad al conectarse a los productos afectados y ejecutar una serie de comandos."}], "lastModified": "2019-06-05T18:21:54.580", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:ap4050dn-e_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6923D0FA-AEC5-43F6-B50F-D65633EC5498", "versionEndExcluding": "v200r009c00"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:ap4050dn-e:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9746576E-94D6-4866-B10E-E03FEC4DE9A5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}