CVE-2017-15344

Huawei AR3200 with software V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20,…

High7.5EPSS 1.4%

Published: 15 Feb 2018
Updated: 5 Aug 2024
Reserved: 14 Oct 2017
Assigned by: huawei

Description

Huawei AR3200 with software V200R006C10, V200R006C11, V200R007C00, V200R007C01, V200R007C02, V200R008C00, V200R008C10, V200R008C20, V200R008C30 has an integer overflow vulnerability. The software does not sufficiently validate certain field in SCTP messages, a remote unauthenticated attacker could send a crafted SCTP message to the device. Successful exploit could cause system reboot.

Timeline

2017
14 Oct 2017
14 Oct 2017
ID reserved
By huawei
2018
15 Feb 20184 months later
15 Feb 2018· 4 months later
Published
2024
5 Aug 20246 years later
5 Aug 2024· 6 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2017-15344, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	3.0	High7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (exploitation in 30 days): 1.4% · top 28% of all CVEs (8 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

integer overflow
CWE-190 (opens in a new tab)All about CWE-190 and its CVEs

Affected products

Huawei Technologies Co., Ltd. · AR3200
- affected V200R006C10,V200R006C11,V200R007C00,V200R007C01,V200R007C02,V200R008C00,V200R008C10,V200R008C20,V200R008C30

References (1)

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171129-02-sctp-en (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2017-15344](https://cveledger.app/badge/CVE-2017-15344.svg)](https://cveledger.app/cve/CVE-2017-15344)

Record last updated 5 Aug 2024, 19:50 UTC.