What is CVE-2017-17222?

CVE-2017-17222 is a high-severity vulnerability in Huawei Espace 7950, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2018-03-09.

How severe is CVE-2017-17222?

High severity. CVSS v3 base score is 8.8 out of 10.

Improper input validation in Huawei Espace 7950

CVE-2017-17222

Import Language Package function in Huawei eSpace 7950 V200R003C30; eSpace 8950 V200R003C00; V200R003C30 has a remote code execution vulnerability. An authenticated, remote attacker can craft and send the packets to the affected products after Language Package is uploaded. Due to insufficient verification of the packets, this could be exploited to execute arbitrary code.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.012 (67.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Huawei Espace_7950
Huawei Espace_7950_firmware — versions v200r003c30
Huawei Espace_8950
Huawei Espace_8950_firmware — versions v200r003c00, v200r003c30
Huawei Technologies Co., Ltd. Espace 7950; 8950 — versions V200R003C30, eSpace 8950 V200R003C00, eSpace 7950 V200R003C30

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

psirt@huawei.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2017-17222?: CVE-2017-17222 is a high-severity vulnerability in Huawei Espace 7950, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2018-03-09.
How severe is CVE-2017-17222?: High severity. CVSS v3 base score is 8.8 out of 10.