Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

Huawei AR120/AR150 firmware can be tricked to misbehave

CVE-2019-5291 · published 6 years ago
Summary

Certain Huawei AR120 and AR150 firmware versions do not fully check that data coming from another device is genuine. An attacker on the network could capture, alter, and replay those messages, causing the affected router or switch to behave incorrectly or stop working. Install the latest firmware updates from Huawei and protect the network with proper segmentation and monitoring to reduce the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
huawei ar120-s_firmware v200r005c20
v200r006c10
v200r007c00
v200r008c50
cpe:2.3:o:huawei:ar120-s_firmware:v200r005c20:*:*:*:*:*:*:*
huawei ar1200_firmware v200r005c00
v200r006c10
v200r007c00
v200r008c50
cpe:2.3:o:huawei:ar1200_firmware:v200r005c00:*:*:*:*:*:*:*
huawei ar1200-s_firmware v200r005c20
v200r006c10
v200r007c00
v200r008c50
cpe:2.3:o:huawei:ar1200-s_firmware:v200r005c20:*:*:*:*:*:*:*
huawei ar150_firmware v200r005c20
v200r006c10
v200r007c00
v200r008c50
cpe:2.3:o:huawei:ar150_firmware:v200r005c20:*:*:*:*:*:*:*
huawei ar150-s_firmware v200r005c20
v200r006c10
v200r007c00
v200r008c50
cpe:2.3:o:huawei:ar150-s_firmware:v200r005c20:*:*:*:*:*:*:*
huawei ar160_firmware v200r005c20
v200r006c10
v200r007c00
v200r008c50
cpe:2.3:o:huawei:ar160_firmware:v200r005c20:*:*:*:*:*:*:*
huawei ar200_firmware v200r005c20
v200r006c10
v200r007c00
v200r008c50
cpe:2.3:o:huawei:ar200_firmware:v200r005c20:*:*:*:*:*:*:*
huawei ar200-s_firmware v200r005c20
v200r006c10
v200r007c00
v200r008c50
cpe:2.3:o:huawei:ar200-s_firmware:v200r005c20:*:*:*:*:*:*:*
huawei ar2200_firmware v200r005c20
v200r006c10
v200r007c00
v200r008c50
cpe:2.3:o:huawei:ar2200_firmware:v200r005c20:*:*:*:*:*:*:*
huawei ar2200-s_firmware v200r005c20
v200r006c10
v200r007c00
v200r008c50
cpe:2.3:o:huawei:ar2200-s_firmware:v200r005c20:*:*:*:*:*:*:*
huawei ar3200_firmware v200r005c20
v200r006c10
v200r007c00
v200r008c50
cpe:2.3:o:huawei:ar3200_firmware:v200r005c20:*:*:*:*:*:*:*
huawei ar3600_firmware v200r006c10
v200r007c00
v200r008c50
cpe:2.3:o:huawei:ar3600_firmware:v200r006c10:*:*:*:*:*:*:*
huawei cloudengine_12800_firmware v200r002c10
v200r002c20
cpe:2.3:o:huawei:cloudengine_12800_firmware:v200r002c10:*:*:*:*:*:*:*
huawei netengine16ex_firmware v200r005c20
v200r006c10
v200r007c00
v200r008c50
cpe:2.3:o:huawei:netengine16ex_firmware:v200r005c20:*:*:*:*:*:*:*
huawei s6700_firmware v200r008c00
v200r010c00spc300
v200r010c00spc600
v200r011c00spc200
cpe:2.3:o:huawei:s6700_firmware:v200r008c00:*:*:*:*:*:*:*
huawei srg1300_firmware v200r005c20
v200r006c10
v200r007c00
v200r008c50
cpe:2.3:o:huawei:srg1300_firmware:v200r005c20:*:*:*:*:*:*:*
huawei srg2300_firmware v200r005c20
v200r006c10
v200r007c00
v200r008c50
cpe:2.3:o:huawei:srg2300_firmware:v200r005c20:*:*:*:*:*:*:*
huawei srg3300_firmware v200r005c20
v200r006c10
v200r007c00
v200r008c50
cpe:2.3:o:huawei:srg3300_firmware:v200r005c20:*:*:*:*:*:*:*
Original advisory text
Some Huawei products have an insufficient verification of data authenticity vulnerability. A remote, unauthenticated attacker has to intercept specific packets between two devices, modify the packe...
Some Huawei products have an insufficient verification of data authenticity vulnerability. A remote, unauthenticated attacker has to intercept specific packets between two devices, modify the packets, and send the modified packets to the peer device. Due to insufficient verification of some fields in the packets, an attacker may exploit the vulnerability to cause the target device to be abnormal.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-345Insufficient Verification of Data Authenticity
Timeline
Published13 Dec 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-5291 · NVD
Track software like this
Free during beta