CVE-2017-17150 (GCVE-0-2017-17150)

Vulnerability from cvelistv5 – Published: 2018-03-09 17:00 – Updated: 2024-08-05 20:43
VLAI
Summary
Timergrp module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an DoS vulnerability due to insufficient validation of the parameter. An authenticated local attacker may call a special API with special parameter, which cause an infinite loop. Successful exploit of this vulnerability can allow an attacker to launch DOS attack.
Severity
5.5 (Medium)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
  • DoS
Assigner
References
Impacted products
Vendor Product Version CPE status
Huawei Technologies Co., Ltd. DP300; RP200; TE30; TE40; TE50; TE60 Affected: DP300 V500R002C00
Affected: RP200 V500R002C00
Affected: V600R006C00
Affected: TE30 V100R001C10
Affected: V500R002C00
Affected: TE40 V500R002C00
Affected: TE50 V500R002C00
Affected: TE60 V100R001C10
guessed Create a notification for this product.
Date Public
2017-12-20 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T20:43:59.921Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-01-vpp-en"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "DP300; RP200; TE30; TE40; TE50; TE60",
          "vendor": "Huawei Technologies Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "DP300 V500R002C00"
            },
            {
              "status": "affected",
              "version": "RP200 V500R002C00"
            },
            {
              "status": "affected",
              "version": "V600R006C00"
            },
            {
              "status": "affected",
              "version": "TE30 V100R001C10"
            },
            {
              "status": "affected",
              "version": "V500R002C00"
            },
            {
              "status": "affected",
              "version": "TE40 V500R002C00"
            },
            {
              "status": "affected",
              "version": "TE50 V500R002C00"
            },
            {
              "status": "affected",
              "version": "TE60 V100R001C10"
            }
          ]
        }
      ],
      "datePublic": "2017-12-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Timergrp module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an DoS vulnerability due to insufficient validation of the parameter. An authenticated local attacker may call a special API with special parameter, which cause an infinite loop. Successful exploit of this vulnerability can allow an attacker to launch DOS attack."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "DoS",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-09T16:57:01.000Z",
        "orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
        "shortName": "huawei"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-01-vpp-en"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@huawei.com",
          "ID": "CVE-2017-17150",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "DP300; RP200; TE30; TE40; TE50; TE60",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "DP300 V500R002C00"
                          },
                          {
                            "version_value": "RP200 V500R002C00"
                          },
                          {
                            "version_value": "V600R006C00"
                          },
                          {
                            "version_value": "TE30 V100R001C10"
                          },
                          {
                            "version_value": "V500R002C00"
                          },
                          {
                            "version_value": "V600R006C00"
                          },
                          {
                            "version_value": "TE40 V500R002C00"
                          },
                          {
                            "version_value": "V600R006C00"
                          },
                          {
                            "version_value": "TE50 V500R002C00"
                          },
                          {
                            "version_value": "V600R006C00"
                          },
                          {
                            "version_value": "TE60 V100R001C10"
                          },
                          {
                            "version_value": "V500R002C00"
                          },
                          {
                            "version_value": "V600R006C00"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Huawei Technologies Co., Ltd."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Timergrp module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an DoS vulnerability due to insufficient validation of the parameter. An authenticated local attacker may call a special API with special parameter, which cause an infinite loop. Successful exploit of this vulnerability can allow an attacker to launch DOS attack."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "DoS"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-01-vpp-en",
              "refsource": "CONFIRM",
              "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-01-vpp-en"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
    "assignerShortName": "huawei",
    "cveId": "CVE-2017-17150",
    "datePublished": "2018-03-09T17:00:00.000Z",
    "dateReserved": "2017-12-04T00:00:00.000Z",
    "dateUpdated": "2024-08-05T20:43:59.921Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2017-17150",
      "date": "2026-10-01",
      "epss": "0.00191",
      "percentile": "0.07853"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:huawei:dp300_firmware:v500r002c00:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8871106B-D3AF-4CFB-A544-1FA411642428",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:huawei:dp300:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7F3483B2-9EB6-4E34-900A-945C04A3160D",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:huawei:rp200_firmware:v500r002c00:*:*:*:*:*:*:*",
                    "matchCriteriaId": "16C1ED34-BC94-4AAC-ADF4-5FCD637E5B4A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:huawei:rp200_firmware:v600r006c00:*:*:*:*:*:*:*",
                    "matchCriteriaId": "67731A77-1DD4-49B2-B437-2850C9583750",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:huawei:rp200:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "98275088-2FBE-42F4-AAEC-DF02950B803D",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:huawei:te30_firmware:v100r001c10:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DA3EF476-42D7-4758-8DCB-373F46BF1CF5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:huawei:te30_firmware:v500r002c00:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9DEA387B-4F45-438F-8086-6E80B553163C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:huawei:te30_firmware:v600r006c00:*:*:*:*:*:*:*",
                    "matchCriteriaId": "018039EB-7265-4B71-B462-4734FD1D0503",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:huawei:te30:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1146F99B-5344-4CD3-AF3F-CD3FE6F6DD91",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:huawei:te40_firmware:v500r002c00:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DDD87254-ABAD-4DFF-BC0D-2CF030063D6F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:huawei:te40_firmware:v600r006c00:*:*:*:*:*:*:*",
                    "matchCriteriaId": "931FD3B3-A333-4277-AE55-494F5DB9F09F",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:huawei:te40:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "45C3AF58-E030-4E12-A2FD-A4337A5021ED",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:huawei:te50_firmware:v500r002c00:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DF7A4D51-314B-4A77-86A7-9C5237BC4275",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:huawei:te50_firmware:v600r006c00:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A70F8924-DC80-4D6F-BA3E-DBFE32FED788",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:huawei:te50:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A4F188B3-0A63-4704-9B0D-F8DF5D973FA5",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:huawei:te60_firmware:v100r001c10:*:*:*:*:*:*:*",
                    "matchCriteriaId": "092C9FAF-8892-4E16-9C0E-BB1E3488C6C4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:huawei:te60_firmware:v500r002c00:*:*:*:*:*:*:*",
                    "matchCriteriaId": "01BC9042-0485-437F-811F-F8898B3B7EA7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:huawei:te60_firmware:v600r006c00:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4A29049D-F472-4772-8750-20730DA624E9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:huawei:te60:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "999117E9-90C8-4E76-90B5-7D364C0B84BF",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Timergrp module in Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00; V600R006C00 have an DoS vulnerability due to insufficient validation of the parameter. An authenticated local attacker may call a special API with special parameter, which cause an infinite loop. Successful exploit of this vulnerability can allow an attacker to launch DOS attack."
          },
          {
            "lang": "es",
            "value": "El m\u00f3dulo Timergrp en Huawei DP300 V500R002C00; RP200 V500R002C00; V600R006C00; TE30 V100R001C10; V500R002C00; V600R006C00; TE40 V500R002C00; V600R006C00; TE50 V500R002C00; V600R006C00; TE60 V100R001C10; V500R002C00 y V600R006C00 tiene una vulnerabilidad de denegaci\u00f3n de servicio (DoS) debido a la validaci\u00f3n insuficiente del par\u00e1metro. Un atacante local autenticado podr\u00eda llamar a una API especial con un par\u00e1metro especial, lo que provocar\u00eda un bucle infinito. La explotaci\u00f3n con \u00e9xito de esta vulnerabilidad puede permitir que un atacante inicie un ataque DoS."
          }
        ],
        "id": "CVE-2017-17150",
        "lastModified": "2024-11-21T03:17:35.217",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "LOW",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "LOCAL",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 2.1,
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.0"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2018-03-09T17:29:00.597",
        "references": [
          {
            "source": "psirt@huawei.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-01-vpp-en"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-01-vpp-en"
          }
        ],
        "sourceIdentifier": "psirt@huawei.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-835"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.