6.7

CVE-2020-9127

Some Huawei products have a command injection vulnerability. Due to insufficient input validation, an attacker with high privilege may inject some malicious codes in some files of the affected products. Successful exploit may cause command injection.Affected product versions include:NIP6300 versions V500R001C30,V500R001C60;NIP6600 versions V500R001C30,V500R001C60;Secospace USG6300 versions V500R001C30,V500R001C60;Secospace USG6500 versions V500R001C30,V500R001C60;Secospace USG6600 versions V500R001C30,V500R001C60;USG9500 versions V500R001C30,V500R001C60.

Data is provided by the National Vulnerability Database (NVD)
Huawei ≫ Nip6300 Firmware Versionv500r001c30
   Huawei ≫ Nip6300 Version-
Huawei ≫ Nip6300 Firmware Versionv500r001c60
   Huawei ≫ Nip6300 Version-
Huawei ≫ Nip6600 Firmware Versionv500r001c30
   Huawei ≫ Nip6600 Version-
Huawei ≫ Nip6600 Firmware Versionv500r001c60
   Huawei ≫ Nip6600 Version-
Huawei ≫ Secospace Usg6300 Firmware Versionv500r001c30
   Huawei ≫ Secospace Usg6300 Version-
Huawei ≫ Secospace Usg6300 Firmware Versionv500r001c60
   Huawei ≫ Secospace Usg6300 Version-
Huawei ≫ Secospace Usg6500 Firmware Versionv500r001c30
   Huawei ≫ Secospace Usg6500 Version-
Huawei ≫ Secospace Usg6500 Firmware Versionv500r001c60
   Huawei ≫ Secospace Usg6500 Version-
Huawei ≫ Secospace Usg6600 Firmware Versionv500r001c30
   Huawei ≫ Secospace Usg6600 Version-
Huawei ≫ Secospace Usg6600 Firmware Versionv500r001c60
   Huawei ≫ Secospace Usg6600 Version-
Huawei ≫ Usg9500 Firmware Versionv500r001c30
   Huawei ≫ Usg9500 Version-
Huawei ≫ Usg9500 Firmware Versionv500r001c60
   Huawei ≫ Usg9500 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.11% 0.268
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.