CVE-2017-17292

Name of the Vulnerable Software and Affected Versions Huawei AR120-S versions V200R006C10 through V200R008C30 Huawei AR1200 versions V200R006C10 through V200R008C30 Huawei AR1200-S versions V200R006C10 through V200R008C30 Huawei AR150 versions V200R006C10 through V200R008C30 Huawei AR150-S versions V200R006C10 through V200R008C30 Huawei AR160 versions V200R006C10 through V200R008C30 Huawei AR200 versions V200R006C10 through V200R008C30 Huawei AR200-S versions V200R006C10 through V200R008C30 Huawei AR2200 versions V200R006C10 through V200R008C30 Huawei AR2200-S versions V200R006C10 through V200R008C30 Huawei AR3200 versions V200R006C10 through V200R008C30 Huawei AR3600 versions V200R006C10 through V200R008C20 Huawei AR510 versions V200R006C10 through V200R008C30 Huawei DP300 version V500R002C00 Huawei MAX PRESENCE version V100R001C00 Huawei NetEngine16EX versions V200R006C10 through V200R008C30 Huawei RP200 versions V500R002C00 through V600R006C00 Huawei SRG1300 versions V200R006C10 through V200R008C30 Huawei SRG2300 versions V200R006C10 through V200R008C30 Huawei SRG3300 versions V200R006C10 through V200R008C30 Huawei TE30 versions V100R001C02 through V600R006C00 Huawei TE40 versions V500R002C00 through V600R006C00 Huawei TE50 version V500R002C00 Huawei TE60 versions V100R001C01 through V600R006C00 Huawei TP3106 version V100R002C00 Huawei TP3206 versions V100R002C00 through V100R002C10

Description The issue is a denial of service vulnerability in a specific module of the affected Huawei products. An authenticated, local attacker can craft a specific XML file to exploit this vulnerability due to improper handling of input, which will cause some service abnormality.

Recommendations For all affected versions, consider temporarily disabling the specific module until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the specific XML file in the affected products until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.