CVE-2020-1855: Huawei HEGE-570 version 1.0.1.22(SP3); and HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X version 1.0.1.21(SP3) have an insufficient verification vulnerability. An attacker can access the...

Summary

Huawei HEGE-570 version 1.0.1.22(SP3); and HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X version 1.0.1.21(SP3) have an insufficient verification vulnerability. An attacker can access the device physically and exploit this vulnerability to tamper with device information. Successful exploit...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
huawei	hege-560_firmware	1.0.1.21\(sp3\) `cpe:2.3:o:huawei:hege-560_firmware:1.0.1.21\(sp3\):::::::*`
huawei	osca-550_firmware	1.0.1.21\(sp3\) `cpe:2.3:o:huawei:osca-550_firmware:1.0.1.21\(sp3\):::::::*`
huawei	osca-550a_firmware	1.0.1.21\(sp3\) `cpe:2.3:o:huawei:osca-550a_firmware:1.0.1.21\(sp3\):::::::*`
huawei	osca-550ax_firmware	1.0.1.21\(sp3\) `cpe:2.3:o:huawei:osca-550ax_firmware:1.0.1.21\(sp3\):::::::*`
huawei	osca-550x_firmware	1.0.1.21\(sp3\) `cpe:2.3:o:huawei:osca-550x_firmware:1.0.1.21\(sp3\):::::::*`
huawei	hege-570_firmware	1.0.1.22\(sp3\) `cpe:2.3:o:huawei:hege-570_firmware:1.0.1.22\(sp3\):::::::*`

Original advisory text

Huawei HEGE-570 version 1.0.1.22(SP3); and HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X version 1.0.1.21(SP3) have an insufficient verification vulnerability. An attacker can access the...

Huawei HEGE-570 version 1.0.1.22(SP3); and HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X version 1.0.1.21(SP3) have an insufficient verification vulnerability. An attacker can access the device physically and exploit this vulnerability to tamper with device information. Successful exploit may cause service abnormal.

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200122-03-osca-en Vendor Advisory