Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.3

Huawei AR3200 and NGFW Module may run out of memory

CVE-2017-17330 · published 8 years ago
Summary

Certain firmware versions for Huawei AR3200 routers and the NGFW security module can leak memory when processing specially crafted XML files. If an attacker who already has access uploads such a file, the device could exhaust its memory and stop working properly. Update to the latest firmware or apply the vendor's patch to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
huawei ar3200_firmware v200r005c32
v200r006c10
v200r006c11
v200r007c00
v200r007c01
v200r007c02
v200r008c00
v200r008c10
v200r008c20
v200r008c30
cpe:2.3:o:huawei:ar3200_firmware:v200r005c32:*:*:*:*:*:*:*
huawei ngfw_module_firmware v500r001c00
v500r001c20
v500r002c00
cpe:2.3:o:huawei:ngfw_module_firmware:v500r001c00:*:*:*:*:*:*:*
Original advisory text
Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 hav...
Huawei AR3200 V200R005C32; V200R006C10; V200R006C11; V200R007C00; V200R007C01; V200R007C02; V200R008C00; V200R008C10; V200R008C20; V200R008C30; NGFW Module V500R001C00; V500R001C20; V500R002C00 have a memory leak vulnerability. The software does not release allocated memory properly when parse XML element data. An authenticated attacker could upload a crafted XML file, successful exploit could cause the system service abnormal since run out of memory.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
3.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-772Missing Release of Resource after Effective Lifetime
Timeline
Published9 Mar 2018
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-17330 · NVD
Track software like this
Free during beta