CVE-2019-5304: huawei ar120-s_firmware Classic Buffer Overflow

Vulnerability summary

CVE-2019-5304 is a high (CVSS 7.8) Classic Buffer Overflow vulnerability in huawei ar120-s_firmware. EPSS estimates a 0.97% chance of exploitation in the next 30 days, higher than 61.3% of scored vulnerabilities.

Timeline

1. 03-01-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Some Huawei products have a buffer error vulnerability. An unauthenticated, remote attacker could send specific MPLS Echo Request messages to the target products. Due to insufficient input validation of some parameters in the messages, successful exploit may cause the device to reset.

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.