Vulnerability in Huawei Usg9500

CVE-2019-19411

USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 have an information leakage vulnerability. Due to improper processing of the initialization vector used in a specific encryption algorithm, an attacker who gains access to this cryptographic primitive may exploit this vulnerability to cause the value of the confidentiality associated with its use to be diminished.

Vulnerability class: Dirty Pipe (CVE-2022-0847)

EPSS: 0.012 (66.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

  • Huawei Usg9500
  • Huawei Usg9500_firmware — versions v500r001c30spc100, v500r001c30spc200, v500r001c30spc600
  • N/a Usg9500 — versions V500R001C30SPC100,V500R001C30SPC200,V500R001C30SPC600,V500R001C60SPC500,V500R005C00SPC100,V500R005C00SPC200

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2019-19411?
CVE-2019-19411 is a low-severity vulnerability in Huawei Usg9500, classified under Improper Initialization. CVSS score: 3.7/10. Published 2020-01-21.
How severe is CVE-2019-19411?
Low severity. CVSS v3 base score is 3.7 out of 10.
Is CVE-2019-19411 known to be exploited?
2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.