Auth bypass in Huawei Hege-560
CVE-2020-1842
Huawei HEGE-560 version 1.0.1.20(SP2); OSCA-550 and OSCA-550A version 1.0.0.71(SP1); and OSCA-550AX and OSCA-550X version 1.0.0.71(SP2) have an insufficient authentication vulnerability. An attacker can access the device physically and perform specific operations to exploit this vulnerability. Successful exploitation may cause the attacker obtain high privilege.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (13.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 13th percentile — 13.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Huawei Hege-560 — versions 1.0.1.20(SP2)
- Huawei Hege-560 Firmware — versions 1.0.1.20(sp2), 1.0.1.20\(sp2\)
- Huawei Osca-550
- Huawei Osca-550a
- Huawei Osca-550a Firmware — versions 1.0.0.71(sp1), 1.0.0.71\(sp1\)
- Huawei Osca-550ax
- Huawei Osca-550ax Firmware — versions 1.0.0.71\(sp2\), 1.0.0.71(sp2)
- Huawei Osca-550ax, Osca-550x — versions 1.0.0.71(SP2)
- Huawei Osca-550 Firmware — versions 1.0.0.71(sp1), 1.0.0.71\(sp1\)
- Huawei Osca-550, Osca-550a — versions 1.0.0.71(SP1)
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2020-1842?
- CVE-2020-1842 is a medium-severity vulnerability in Huawei Hege-560, classified under Improper Authentication. CVSS score: 6.8/10. Published 2020-02-18.
- How severe is CVE-2020-1842?
- Medium severity. CVSS v3 base score is 6.8 out of 10.