What is CVE-2020-9137?

CVE-2020-9137 is a medium-severity vulnerability in Huawei Cloudengine 12800, classified under Improper Input Validation. CVSS score: 6.7/10. Published 2020-12-24.

How severe is CVE-2020-9137?

Medium severity. CVSS v3 base score is 6.7 out of 10.

Improper input validation in Huawei Cloudengine 12800

CVE-2020-9137

There is a privilege escalation vulnerability in some versions of CloudEngine 12800,CloudEngine 5800,CloudEngine 6800 and CloudEngine 7800. Due to insufficient input validation, a local attacker with high privilege may execute some specially crafted scripts in the affected products. Successful exploit will cause privilege escalation.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2020-12-24 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.002 (11.3th percentile), scored 2026-10-23.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 11th percentile — 11.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

Huawei Cloudengine 12800
Huawei Cloudengine 12800 Firmware — versions v200r002c50spc800, v200r003c00spc810, v200r005c00spc800
Huawei Cloudengine 5800
Huawei Cloudengine 5800 Firmware — versions v200r002c50spc800, v200r003c00spc810, v200r005c00spc800
Huawei Cloudengine 6800
Huawei Cloudengine 6800 Firmware — versions v200r002c50spc800, v200r003c00spc810, v200r005c00spc800
Huawei Cloudengine 7800
Huawei Cloudengine 7800 Firmware — versions v200r002c50spc800, v200r003c00spc810, v200r005c00spc800
Cloudengine 12800;cloudengine 5800;cloudengine 6800;cloudengine 7800 — versions V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R019C00SPC800,V200R019C10SPC800, V200R002C50SPC800,V200R003C00SPC810,V200R005C00SPC800,V200R005C10SPC800,V200R005C20SPC800,V200R019C00SPC800,V200R019C10SPC800

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20201202-02-privilege-en (Vendor Advisory)

Frequently asked questions

What is CVE-2020-9137?: CVE-2020-9137 is a medium-severity vulnerability in Huawei Cloudengine 12800, classified under Improper Input Validation. CVSS score: 6.7/10. Published 2020-12-24.
How severe is CVE-2020-9137?: Medium severity. CVSS v3 base score is 6.7 out of 10.