CVE Feed

    Dashboard / CVE / CVE-2019-5300

    CVE-2019-5300

    There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR2200-S, AR3200, SRG1300, SRG2300 and SRG3300 Huawei routers. The vulnerability is due to the affected software improperly verifying digital signatures for the software image in the affected device. A local attacker with high privilege may exploit the vulnerability to bypass integrity checks for software images and install a malicious software image on the affected device.

    Published:Jun 4, 2019
    Last Modified:Nov 21, 2024
    EPS:Jun 4, 2019
    EPSS Score:0.00011
    CVSS Score:6.7

    Affected Products

    Vendor
    Huawei
    Product
    Ar1200-s Firmware
    Vendor
    Huawei
    Product
    Ar1200 Firmware
    Vendor
    Huawei
    Product
    Ar1200e
    Vendor
    Huawei
    Product
    Ar1220c
    Vendor
    Huawei
    Product
    Ar1220ev
    Vendor
    Huawei
    Product
    Ar1220evw
    Vendor
    Huawei
    Product
    Ar1220f-s
    Vendor
    Huawei
    Product
    Ar150 Firmware
    Vendor
    Huawei
    Product
    Ar158evw
    Vendor
    Huawei
    Product
    Ar160 Firmware
    Vendor
    Huawei
    Product
    Ar161
    Vendor
    Huawei
    Product
    Ar161ew
    Vendor
    Huawei
    Product
    Ar161f
    Vendor
    Huawei
    Product
    Ar161f-dgp
    Vendor
    Huawei
    Product
    Ar161fg-l
    Vendor
    Huawei
    Product
    Ar161fgw-l
    Vendor
    Huawei
    Product
    Ar161fv-1p
    Vendor
    Huawei
    Product
    Ar161fw
    Vendor
    Huawei
    Product
    Ar161g-l
    Vendor
    Huawei
    Product
    Ar161w
    Vendor
    Huawei
    Product
    Ar168f
    Vendor
    Huawei
    Product
    Ar168f-4p
    Vendor
    Huawei
    Product
    Ar169
    Vendor
    Huawei
    Product
    Ar169egw-l
    Vendor
    Huawei
    Product
    Ar169ew
    Vendor
    Huawei
    Product
    Ar169f
    Vendor
    Huawei
    Product
    Ar169fgw-l
    Vendor
    Huawei
    Product
    Ar169fvw
    Vendor
    Huawei
    Product
    Ar169fvw-8s
    Vendor
    Huawei
    Product
    Ar169g-l
    Vendor
    Huawei
    Product
    Ar169jfvw-2s
    Vendor
    Huawei
    Product
    Ar169w
    Vendor
    Huawei
    Product
    Ar200 Firmware
    Vendor
    Huawei
    Product
    Ar201
    Vendor
    Huawei
    Product
    Ar2200 Firmware
    Vendor
    Huawei
    Product
    Ar2200s
    Vendor
    Huawei
    Product
    Ar2200s Firmware
    Vendor
    Huawei
    Product
    Ar2204-27ge
    Vendor
    Huawei
    Product
    Ar2204-27ge-p
    Vendor
    Huawei
    Product
    Ar2204-51ge-p
    Vendor
    Huawei
    Product
    Ar2204e
    Vendor
    Huawei
    Product
    Ar2204xe
    Vendor
    Huawei
    Product
    Ar2220e
    Vendor
    Huawei
    Product
    Ar2240
    Vendor
    Huawei
    Product
    Ar2240c
    Vendor
    Huawei
    Product
    Ar3200 Firmware
    Vendor
    Huawei
    Product
    Ar3260
    Vendor
    Huawei
    Product
    Srg1300 Firmware
    Vendor
    Huawei
    Product
    Srg1320vw
    Vendor
    Huawei
    Product
    Srg2300 Firmware
    Vendor
    Huawei
    Product
    Srg2320e
    Vendor
    Huawei
    Product
    Srg3300 Firmware
    Vendor
    Huawei
    Product
    Srg3340

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-463 Padding Oracle Crypto Attack
    CAPEC-475 Signature Spoofing by Improper Validation

    Related CVEs

    CVE-2019-19415 (CVSS 7.5) — The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could e…
    CVE-2019-19416 (CVSS 7.5) — The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could e…
    CVE-2019-19417 (CVSS 7.5) — The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could e…
    CVE-2020-9071 (CVSS 6.5) — There is a few bytes out-of-bounds read vulnerability in some Huawei products. The software reads data past th…
    CVE-2019-5304 (CVSS 7.5) — Some Huawei products have a buffer error vulnerability. An unauthenticated, remote attacker could send specifi…
    CVE-2019-5259 (CVSS 6.5) — There is an information leakage vulnerability on some Huawei products(AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR…
    CVE-2019-5291 (CVSS 5.9) — Some Huawei products have an insufficient verification of data authenticity vulnerability. A remote, unauthent…
    CVE-2019-5293 (CVSS 6.5) — Some Huawei products have a memory leak vulnerability when handling some messages. A remote attacker with oper…
    CVE-2019-5294 (CVSS 7.5) — There is an out of bound read vulnerability in some Huawei products. A remote, unauthenticated attacker may se…
    CVE-2017-17253 (CVSS 7.5) — Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C0…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High