medium6.7
CVE-2019-5300
There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR2200-S, AR3200, SRG1300, SRG2300 and SRG3300…
Impact
There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR2200-S, AR3200, SRG1300, SRG2300 and SRG3300 Huawei routers. The vulnerability is due to the affected software improperly verifying digital signatures for the software image in the affected device. A local attacker with high privilege may exploit the vulnerability to bypass integrity checks for software images and install a malicious software image on the affected device.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Huawei | Ar1200 Firmware | Versions v200r007c00, v200r008c20, v200r008c50, v200r009c00, v200r010c00 |
| Huawei | Ar1200-S Firmware | Versions v200r007c00, v200r008c20, v200r008c50, v200r009c00, v200r010c00 |
| Huawei | Ar150 Firmware | Versions v200r007c00, v200r008c20, v200r008c50, v200r009c00, v200r010c00 |
| Huawei | Ar160 Firmware | Versions v200r007c00, v200r008c20, v200r008c50, v200r009c00, v200r010c00 |
| Huawei | Ar200 Firmware | Versions v200r007c00, v200r008c20, v200r008c50, v200r009c00, v200r010c00 |
| Huawei | Ar2200 Firmware | Versions v200r007c00, v200r008c20, v200r008c50, v200r009c00, v200r010c00 |
| Huawei | Ar2200s Firmware | Versions v200r007c00, v200r008c20, v200r008c50, v200r009c00, v200r010c00 |
| Huawei | Ar3200 Firmware | Versions v200r007c00, v200r008c20, v200r008c50, v200r009c00, v200r010c00 |
| Huawei | Srg1300 Firmware | Versions v200r007c00, v200r008c50, v200r009c00, v200r010c00 |
| Huawei | Srg2300 Firmware | Versions v200r007c00, v200r008c50, v200r009c00, v200r010c00 |
| Huawei | Srg3300 Firmware | Versions v200r007c00, v200r008c50, v200r009c00, v200r010c00 |