Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Huawei CloudEngine Memory Leak Risk: Unauthorized Access Possible

CVE-2020-9124 · published 5 years ago
Summary

Some versions of Huawei CloudEngine products have a memory leak issue. An attacker can send a specific message to the product without needing a password, which may lead to unauthorized access. Upgrading to the latest version is recommended to prevent potential security risks.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
huawei cloudengine_12800_firmware v200r002c50spc800
v200r003c00spc810
v200r005c00spc800
v200r005c10spc800
cpe:2.3:o:huawei:cloudengine_12800_firmware:v200r002c50spc800:*:*:*:*:*:*:*
huawei cloudengine_5800_firmware v200r002c50spc800
v200r003c00spc810
v200r005c00spc800
v200r005c10spc800
cpe:2.3:o:huawei:cloudengine_5800_firmware:v200r002c50spc800:*:*:*:*:*:*:*
huawei cloudengine_6800_firmware v200r002c50spc800
v200r003c00spc810
v200r005c00spc800
v200r005c10spc800
cpe:2.3:o:huawei:cloudengine_6800_firmware:v200r002c50spc800:*:*:*:*:*:*:*
huawei cloudengine_7800_firmware v200r002c50spc800
v200r003c00spc810
v200r005c00spc800
v200r005c10spc800
cpe:2.3:o:huawei:cloudengine_7800_firmware:v200r002c50spc800:*:*:*:*:*:*:*
Original advisory text
There is a memory leak vulnerability in some versions of Huawei CloudEngine product. An unauthenticated, remote attacker may exploit this vulnerability by sending specific message to the affected p...
There is a memory leak vulnerability in some versions of Huawei CloudEngine product. An unauthenticated, remote attacker may exploit this vulnerability by sending specific message to the affected product. Due to not release the allocated memory properly, successful exploit may cause memory leak.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-401Memory Leak
Timeline
Published29 Dec 2020
Updated3 Nov 2026
First seen14 Mar 2026
Sources
CVE-2020-9124 · OSV
CVE-2020-9124 · NVD
Track software like this
Free during beta