CVE-2019-5300 : There is a digital signature verification bypass vulnerability in AR1200, AR1200

There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR2200-S, AR3200, SRG1300, SRG2300 and SRG3300 Huawei routers. The vulnerability is due to the affected software improperly verifying digital signatures for the software image in the affected device. A local attacker with high privilege may exploit the vulnerability to bypass integrity checks for software images and install a malicious software image on the affected device.

Published 2019-06-04 19:29:01

Updated 2019-06-05 18:49:48

Source Huawei Technologies

View at NVD, CVE.org

Products affected by CVE-2019-5300

Huawei » Ar3200 Firmware » Version: V200r007c00
cpe:2.3:o:huawei:ar3200_firmware:v200r007c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar3260 » Version: N/A
Huawei » Ar3200 Firmware » Version: V200r008c20
cpe:2.3:o:huawei:ar3200_firmware:v200r008c20:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar3260 » Version: N/A
Huawei » Ar3200 Firmware » Version: V200r008c50
cpe:2.3:o:huawei:ar3200_firmware:v200r008c50:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar3260 » Version: N/A
Huawei » Ar3200 Firmware » Version: V200r010c00
cpe:2.3:o:huawei:ar3200_firmware:v200r010c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar3260 » Version: N/A
Huawei » Ar3200 Firmware » Version: V200r009c00
cpe:2.3:o:huawei:ar3200_firmware:v200r009c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar3260 » Version: N/A
Huawei » Ar200 Firmware » Version: V200r007c00
cpe:2.3:o:huawei:ar200_firmware:v200r007c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar201 » Version: N/A
Huawei » Ar200 Firmware » Version: V200r008c20
cpe:2.3:o:huawei:ar200_firmware:v200r008c20:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar201 » Version: N/A
Huawei » Ar200 Firmware » Version: V200r008c50
cpe:2.3:o:huawei:ar200_firmware:v200r008c50:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar201 » Version: N/A
Huawei » Ar200 Firmware » Version: V200r010c00
cpe:2.3:o:huawei:ar200_firmware:v200r010c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar201 » Version: N/A
Huawei » Ar200 Firmware » Version: V200r009c00
cpe:2.3:o:huawei:ar200_firmware:v200r009c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar201 » Version: N/A
Huawei » Ar1200 Firmware » Version: V200r008c20
cpe:2.3:o:huawei:ar1200_firmware:v200r008c20:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar1200e » Version: N/A
When used together with: Huawei » Ar1220c » Version: N/A
When used together with: Huawei » Ar1220ev » Version: N/A
When used together with: Huawei » Ar1220evw » Version: N/A
Huawei » Ar1200 Firmware » Version: V200r007c00
cpe:2.3:o:huawei:ar1200_firmware:v200r007c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar1200e » Version: N/A
When used together with: Huawei » Ar1220c » Version: N/A
When used together with: Huawei » Ar1220ev » Version: N/A
When used together with: Huawei » Ar1220evw » Version: N/A
Huawei » Ar1200 Firmware » Version: V200r009c00
cpe:2.3:o:huawei:ar1200_firmware:v200r009c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar1200e » Version: N/A
When used together with: Huawei » Ar1220c » Version: N/A
When used together with: Huawei » Ar1220ev » Version: N/A
When used together with: Huawei » Ar1220evw » Version: N/A
Huawei » Ar1200 Firmware » Version: V200r010c00
cpe:2.3:o:huawei:ar1200_firmware:v200r010c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar1200e » Version: N/A
When used together with: Huawei » Ar1220c » Version: N/A
When used together with: Huawei » Ar1220ev » Version: N/A
When used together with: Huawei » Ar1220evw » Version: N/A
Huawei » Ar1200 Firmware » Version: V200r008c50
cpe:2.3:o:huawei:ar1200_firmware:v200r008c50:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar1200e » Version: N/A
When used together with: Huawei » Ar1220c » Version: N/A
When used together with: Huawei » Ar1220ev » Version: N/A
When used together with: Huawei » Ar1220evw » Version: N/A
Huawei » Ar2200 Firmware » Version: V200r008c20
cpe:2.3:o:huawei:ar2200_firmware:v200r008c20:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar2204-27ge » Version: N/A
When used together with: Huawei » Ar2204-27ge-p » Version: N/A
When used together with: Huawei » Ar2204-51ge-p » Version: N/A
When used together with: Huawei » Ar2204e » Version: N/A
When used together with: Huawei » Ar2204xe » Version: N/A
When used together with: Huawei » Ar2220e » Version: N/A
When used together with: Huawei » Ar2240 » Version: N/A
When used together with: Huawei » Ar2240c » Version: N/A
Huawei » Ar2200 Firmware » Version: V200r007c00
cpe:2.3:o:huawei:ar2200_firmware:v200r007c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar2204-27ge » Version: N/A
When used together with: Huawei » Ar2204-27ge-p » Version: N/A
When used together with: Huawei » Ar2204-51ge-p » Version: N/A
When used together with: Huawei » Ar2204e » Version: N/A
When used together with: Huawei » Ar2204xe » Version: N/A
When used together with: Huawei » Ar2220e » Version: N/A
When used together with: Huawei » Ar2240 » Version: N/A
When used together with: Huawei » Ar2240c » Version: N/A
Huawei » Ar2200 Firmware » Version: V200r008c50
cpe:2.3:o:huawei:ar2200_firmware:v200r008c50:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar2204-27ge » Version: N/A
When used together with: Huawei » Ar2204-27ge-p » Version: N/A
When used together with: Huawei » Ar2204-51ge-p » Version: N/A
When used together with: Huawei » Ar2204e » Version: N/A
When used together with: Huawei » Ar2204xe » Version: N/A
When used together with: Huawei » Ar2220e » Version: N/A
When used together with: Huawei » Ar2240 » Version: N/A
When used together with: Huawei » Ar2240c » Version: N/A
Huawei » Ar2200 Firmware » Version: V200r010c00
cpe:2.3:o:huawei:ar2200_firmware:v200r010c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar2204-27ge » Version: N/A
When used together with: Huawei » Ar2204-27ge-p » Version: N/A
When used together with: Huawei » Ar2204-51ge-p » Version: N/A
When used together with: Huawei » Ar2204e » Version: N/A
When used together with: Huawei » Ar2204xe » Version: N/A
When used together with: Huawei » Ar2220e » Version: N/A
When used together with: Huawei » Ar2240 » Version: N/A
When used together with: Huawei » Ar2240c » Version: N/A
Huawei » Ar2200 Firmware » Version: V200r009c00
cpe:2.3:o:huawei:ar2200_firmware:v200r009c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar2204-27ge » Version: N/A
When used together with: Huawei » Ar2204-27ge-p » Version: N/A
When used together with: Huawei » Ar2204-51ge-p » Version: N/A
When used together with: Huawei » Ar2204e » Version: N/A
When used together with: Huawei » Ar2204xe » Version: N/A
When used together with: Huawei » Ar2220e » Version: N/A
When used together with: Huawei » Ar2240 » Version: N/A
When used together with: Huawei » Ar2240c » Version: N/A
Huawei » Ar1200-s Firmware » Version: V200r008c20
cpe:2.3:o:huawei:ar1200-s_firmware:v200r008c20:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar1220f-s » Version: N/A
Huawei » Ar1200-s Firmware » Version: V200r007c00
cpe:2.3:o:huawei:ar1200-s_firmware:v200r007c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar1220f-s » Version: N/A
Huawei » Ar1200-s Firmware » Version: V200r008c50
cpe:2.3:o:huawei:ar1200-s_firmware:v200r008c50:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar1220f-s » Version: N/A
Huawei » Ar1200-s Firmware » Version: V200r009c00
cpe:2.3:o:huawei:ar1200-s_firmware:v200r009c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar1220f-s » Version: N/A
Huawei » Ar1200-s Firmware » Version: V200r010c00
cpe:2.3:o:huawei:ar1200-s_firmware:v200r010c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar1220f-s » Version: N/A
Huawei » Ar150 Firmware » Version: V200r008c20
cpe:2.3:o:huawei:ar150_firmware:v200r008c20:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar158evw » Version: N/A
Huawei » Ar150 Firmware » Version: V200r007c00
cpe:2.3:o:huawei:ar150_firmware:v200r007c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar158evw » Version: N/A
Huawei » Ar150 Firmware » Version: V200r008c50
cpe:2.3:o:huawei:ar150_firmware:v200r008c50:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar158evw » Version: N/A
Huawei » Ar150 Firmware » Version: V200r009c00
cpe:2.3:o:huawei:ar150_firmware:v200r009c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar158evw » Version: N/A
Huawei » Ar150 Firmware » Version: V200r010c00
cpe:2.3:o:huawei:ar150_firmware:v200r010c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar158evw » Version: N/A
Huawei » Ar160 Firmware » Version: V200r007c00
cpe:2.3:o:huawei:ar160_firmware:v200r007c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar161 » Version: N/A
When used together with: Huawei » Ar161ew » Version: N/A
When used together with: Huawei » Ar161f » Version: N/A
When used together with: Huawei » Ar161f-dgp » Version: N/A
When used together with: Huawei » Ar161fg-l » Version: N/A
When used together with: Huawei » Ar161fgw-l » Version: N/A
When used together with: Huawei » Ar161fv-1p » Version: N/A
When used together with: Huawei » Ar161fw » Version: N/A
When used together with: Huawei » Ar161g-l » Version: N/A
When used together with: Huawei » Ar161w » Version: N/A
When used together with: Huawei » Ar168f » Version: N/A
When used together with: Huawei » Ar168f-4p » Version: N/A
When used together with: Huawei » Ar169 » Version: N/A
When used together with: Huawei » Ar169egw-l » Version: N/A
When used together with: Huawei » Ar169ew » Version: N/A
When used together with: Huawei » Ar169f » Version: N/A
When used together with: Huawei » Ar169fgw-l » Version: N/A
When used together with: Huawei » Ar169fvw » Version: N/A
When used together with: Huawei » Ar169fvw-8s » Version: N/A
When used together with: Huawei » Ar169g-l » Version: N/A
When used together with: Huawei » Ar169jfvw-2s » Version: N/A
When used together with: Huawei » Ar169w » Version: N/A
Huawei » Ar160 Firmware » Version: V200r008c20
cpe:2.3:o:huawei:ar160_firmware:v200r008c20:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar161 » Version: N/A
When used together with: Huawei » Ar161ew » Version: N/A
When used together with: Huawei » Ar161f » Version: N/A
When used together with: Huawei » Ar161f-dgp » Version: N/A
When used together with: Huawei » Ar161fg-l » Version: N/A
When used together with: Huawei » Ar161fgw-l » Version: N/A
When used together with: Huawei » Ar161fv-1p » Version: N/A
When used together with: Huawei » Ar161fw » Version: N/A
When used together with: Huawei » Ar161g-l » Version: N/A
When used together with: Huawei » Ar161w » Version: N/A
When used together with: Huawei » Ar168f » Version: N/A
When used together with: Huawei » Ar168f-4p » Version: N/A
When used together with: Huawei » Ar169 » Version: N/A
When used together with: Huawei » Ar169egw-l » Version: N/A
When used together with: Huawei » Ar169ew » Version: N/A
When used together with: Huawei » Ar169f » Version: N/A
When used together with: Huawei » Ar169fgw-l » Version: N/A
When used together with: Huawei » Ar169fvw » Version: N/A
When used together with: Huawei » Ar169fvw-8s » Version: N/A
When used together with: Huawei » Ar169g-l » Version: N/A
When used together with: Huawei » Ar169jfvw-2s » Version: N/A
When used together with: Huawei » Ar169w » Version: N/A
Huawei » Ar160 Firmware » Version: V200r008c50
cpe:2.3:o:huawei:ar160_firmware:v200r008c50:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar161 » Version: N/A
When used together with: Huawei » Ar161ew » Version: N/A
When used together with: Huawei » Ar161f » Version: N/A
When used together with: Huawei » Ar161f-dgp » Version: N/A
When used together with: Huawei » Ar161fg-l » Version: N/A
When used together with: Huawei » Ar161fgw-l » Version: N/A
When used together with: Huawei » Ar161fv-1p » Version: N/A
When used together with: Huawei » Ar161fw » Version: N/A
When used together with: Huawei » Ar161g-l » Version: N/A
When used together with: Huawei » Ar161w » Version: N/A
When used together with: Huawei » Ar168f » Version: N/A
When used together with: Huawei » Ar168f-4p » Version: N/A
When used together with: Huawei » Ar169 » Version: N/A
When used together with: Huawei » Ar169egw-l » Version: N/A
When used together with: Huawei » Ar169ew » Version: N/A
When used together with: Huawei » Ar169f » Version: N/A
When used together with: Huawei » Ar169fgw-l » Version: N/A
When used together with: Huawei » Ar169fvw » Version: N/A
When used together with: Huawei » Ar169fvw-8s » Version: N/A
When used together with: Huawei » Ar169g-l » Version: N/A
When used together with: Huawei » Ar169jfvw-2s » Version: N/A
When used together with: Huawei » Ar169w » Version: N/A
Huawei » Ar160 Firmware » Version: V200r009c00
cpe:2.3:o:huawei:ar160_firmware:v200r009c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar161 » Version: N/A
When used together with: Huawei » Ar161ew » Version: N/A
When used together with: Huawei » Ar161f » Version: N/A
When used together with: Huawei » Ar161f-dgp » Version: N/A
When used together with: Huawei » Ar161fg-l » Version: N/A
When used together with: Huawei » Ar161fgw-l » Version: N/A
When used together with: Huawei » Ar161fv-1p » Version: N/A
When used together with: Huawei » Ar161fw » Version: N/A
When used together with: Huawei » Ar161g-l » Version: N/A
When used together with: Huawei » Ar161w » Version: N/A
When used together with: Huawei » Ar168f » Version: N/A
When used together with: Huawei » Ar168f-4p » Version: N/A
When used together with: Huawei » Ar169 » Version: N/A
When used together with: Huawei » Ar169egw-l » Version: N/A
When used together with: Huawei » Ar169ew » Version: N/A
When used together with: Huawei » Ar169f » Version: N/A
When used together with: Huawei » Ar169fgw-l » Version: N/A
When used together with: Huawei » Ar169fvw » Version: N/A
When used together with: Huawei » Ar169fvw-8s » Version: N/A
When used together with: Huawei » Ar169g-l » Version: N/A
When used together with: Huawei » Ar169jfvw-2s » Version: N/A
When used together with: Huawei » Ar169w » Version: N/A
Huawei » Ar160 Firmware » Version: V200r010c00
cpe:2.3:o:huawei:ar160_firmware:v200r010c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar161 » Version: N/A
When used together with: Huawei » Ar161ew » Version: N/A
When used together with: Huawei » Ar161f » Version: N/A
When used together with: Huawei » Ar161f-dgp » Version: N/A
When used together with: Huawei » Ar161fg-l » Version: N/A
When used together with: Huawei » Ar161fgw-l » Version: N/A
When used together with: Huawei » Ar161fv-1p » Version: N/A
When used together with: Huawei » Ar161fw » Version: N/A
When used together with: Huawei » Ar161g-l » Version: N/A
When used together with: Huawei » Ar161w » Version: N/A
When used together with: Huawei » Ar168f » Version: N/A
When used together with: Huawei » Ar168f-4p » Version: N/A
When used together with: Huawei » Ar169 » Version: N/A
When used together with: Huawei » Ar169egw-l » Version: N/A
When used together with: Huawei » Ar169ew » Version: N/A
When used together with: Huawei » Ar169f » Version: N/A
When used together with: Huawei » Ar169fgw-l » Version: N/A
When used together with: Huawei » Ar169fvw » Version: N/A
When used together with: Huawei » Ar169fvw-8s » Version: N/A
When used together with: Huawei » Ar169g-l » Version: N/A
When used together with: Huawei » Ar169jfvw-2s » Version: N/A
When used together with: Huawei » Ar169w » Version: N/A
Huawei » Srg1300 Firmware » Version: V200r007c00
cpe:2.3:o:huawei:srg1300_firmware:v200r007c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Srg1320vw » Version: N/A
Huawei » Srg1300 Firmware » Version: V200r009c00
cpe:2.3:o:huawei:srg1300_firmware:v200r009c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Srg1320vw » Version: N/A
Huawei » Srg1300 Firmware » Version: V200r010c00
cpe:2.3:o:huawei:srg1300_firmware:v200r010c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Srg1320vw » Version: N/A
Huawei » Srg1300 Firmware » Version: V200r008c50
cpe:2.3:o:huawei:srg1300_firmware:v200r008c50:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Srg1320vw » Version: N/A
Huawei » Srg2300 Firmware » Version: V200r007c00
cpe:2.3:o:huawei:srg2300_firmware:v200r007c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Srg2320e » Version: N/A
Huawei » Srg2300 Firmware » Version: V200r008c50
cpe:2.3:o:huawei:srg2300_firmware:v200r008c50:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Srg2320e » Version: N/A
Huawei » Srg2300 Firmware » Version: V200r010c00
cpe:2.3:o:huawei:srg2300_firmware:v200r010c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Srg2320e » Version: N/A
Huawei » Srg2300 Firmware » Version: V200r009c00
cpe:2.3:o:huawei:srg2300_firmware:v200r009c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Srg2320e » Version: N/A
Huawei » Srg3300 Firmware » Version: V200r007c00
cpe:2.3:o:huawei:srg3300_firmware:v200r007c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Srg3340 » Version: N/A
Huawei » Srg3300 Firmware » Version: V200r009c00
cpe:2.3:o:huawei:srg3300_firmware:v200r009c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Srg3340 » Version: N/A
Huawei » Srg3300 Firmware » Version: V200r008c50
cpe:2.3:o:huawei:srg3300_firmware:v200r008c50:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Srg3340 » Version: N/A
Huawei » Srg3300 Firmware » Version: V200r010c00
cpe:2.3:o:huawei:srg3300_firmware:v200r010c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Srg3340 » Version: N/A
Huawei » Ar2200s Firmware » Version: V200r008c50
cpe:2.3:o:huawei:ar2200s_firmware:v200r008c50:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar2200s » Version: N/A
Huawei » Ar2200s Firmware » Version: V200r010c00
cpe:2.3:o:huawei:ar2200s_firmware:v200r010c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar2200s » Version: N/A
Huawei » Ar2200s Firmware » Version: V200r007c00
cpe:2.3:o:huawei:ar2200s_firmware:v200r007c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar2200s » Version: N/A
Huawei » Ar2200s Firmware » Version: V200r008c20
cpe:2.3:o:huawei:ar2200s_firmware:v200r008c20:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar2200s » Version: N/A
Huawei » Ar2200s Firmware » Version: V200r009c00
cpe:2.3:o:huawei:ar2200s_firmware:v200r009c00:*:*:*:*:*:*:*
Matching versions
When used together with: Huawei » Ar2200s » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-5300

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-5300

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
6.7	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-5300

CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-5300

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190320-01-ar-en

Security Advisory - Digital Signature Verification Bypass Vulnerability in Some Huawei Routers
Vendor Advisory

Jump to

Vulnerability Details : CVE-2019-5300

Products affected by CVE-2019-5300

Exploit prediction scoring system (EPSS) score for CVE-2019-5300

CVSS scores for CVE-2019-5300

CWE ids for CVE-2019-5300

References for CVE-2019-5300