RCE in Huawei Nip6300
CVE-2020-9127
Some Huawei products have a command injection vulnerability. Due to insufficient input validation, an attacker with high privilege may inject some malicious codes in some files of the affected products. Successful exploit may cause command injection.Affected product versions include:NIP6300 versions V500R001C30,V500R001C60;NIP6600 versions V500R001C30,V500R001C60;Secospace USG6300 versions V500R001C30,V500R001C60;Secospace USG6500 versions V500R001C30,V500R001C60;Secospace USG6600 versions V500R001C30,V500R001C60;USG9500 versions V500R001C30,V500R001C60.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.004 (30.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Huawei Nip6300
- Huawei Nip6300_firmware — versions v500r001c30, v500r001c60
- Huawei Nip6600
- Huawei Nip6600_firmware — versions v500r001c30, v500r001c60
- Huawei Secospace_usg6300
- Huawei Secospace_usg6300_firmware — versions v500r001c30, v500r001c60
- Huawei Secospace_usg6500
- Huawei Secospace_usg6500_firmware — versions v500r001c30, v500r001c60
- Huawei Secospace_usg6600
- Huawei Secospace_usg6600_firmware — versions v500r001c30, v500r001c60
Weakness classification (CWE)
References
- psirt@huawei.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-9127?
- CVE-2020-9127 is a medium-severity vulnerability in Huawei Nip6300, classified under Improper Input Validation. CVSS score: 6.7/10. Published 2020-11-13.
- How severe is CVE-2020-9127?
- Medium severity. CVSS v3 base score is 6.7 out of 10.