Improper input validation in Huawei Cloudengine 12800
CVE-2016-6178
Huawei NE40E and CX600 devices with software before V800R007SPH017; PTN 6900-2-M8 devices with software before V800R007SPH019; NE5000E devices with software before V800R006SPH018; and CloudEngine devices 12800 with software before V100R003SPH010 and V100R005 before V100R005SPH006 allow remote attackers with control plane access to cause a denial of service or execute arbitrary code via a crafted packet.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.030 (87.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 87.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.030 · newest: 0.030 · change: 0.000
Affected products
- Huawei Cloudengine 12800
- Huawei Cloudengine 12800 Firmware — versions v100r003c00, v100r003c10, v100r005c00
- Huawei Cx600
- Huawei Cx600 Firmware — versions v600r008c20, v800r006c00, v800r006c20
- Huawei Ne40e
- Huawei Ne40e Firmware — versions v600r008c20, v800r006c00, v800r006c20
- Huawei Ne5000e
- Huawei Ne5000e Firmware — versions v800r006c00
- Huawei Ptn 6900-2-M8
- Huawei Ptn 6900-2-M8 Firmware — versions v800r007c00
Weakness classification (CWE)
References
- www.huawei.com/en/psirt/security-advisories/huawei-sa-20160713-01-multicast-ldp… (Vendor Advisory)
- www.securityfocus.com/bid/91772 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2016-6178?
- CVE-2016-6178 is a critical-severity vulnerability in Huawei Cloudengine 12800, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2016-08-02.
- How severe is CVE-2016-6178?
- Critical severity. CVSS v3 base score is 9.8 out of 10.