Huawei SMC2.0 Firmware vulnerabilities

12 CVEs affecting Huawei SMC2.0 Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-22299, published 2021-02-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-0708: Microsoft Remote Desktop Services Remote Code Execution Vulnerability, published 2019-05-16. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 100% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends…
CVE-2017-15332, published 2018-02-15. Medium severity, CVSS 5.3. EPSS: 1.5% chance of exploitation in the next 30 days. Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR1200-S V200R006C10, V200R007C00,…
CVE-2017-15331, published 2018-02-15. Medium severity, CVSS 5.3. EPSS: 1.5% chance of exploitation in the next 30 days. Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR1200-S V200R006C10, V200R007C00,…
CVE-2017-17301, published 2018-02-15. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Huawei AR120-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, AR1200 V200R005C20, V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, AR1200-S V200R005C32, V200R006C10,…
CVE-2019-19417, published 2020-07-08. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the specially crafted messages to the…
CVE-2019-19416, published 2020-07-08. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the specially crafted messages to the…
CVE-2019-19415, published 2020-07-08. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the specially crafted messages to the…
CVE-2017-8163, published 2017-11-22. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. AR120-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR1200 with software V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30,AR1200-S with…
CVE-2017-8162, published 2017-11-22. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. AR120-S with software V200R006C10, V200R007C00, V200R008C20, V200R008C30,AR1200 with software V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30,AR1200-S with…
CVE-2017-8213, published 2017-11-22. Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days. Huawei SMC2.0 with software of V100R003C10, V100R005C00SPC100, V100R005C00SPC101B001T, V100R005C00SPC102, V100R005C00SPC103, V100R005C00SPC200, V100R005C00SPC201T, V500R002C00, V600R006C00 has an…

Latest

CVE-2021-22299, published 2021-02-06. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. There is a local privilege escalation vulnerability in some Huawei products. A local, authenticated attacker could craft specific commands to exploit this vulnerability. Successful exploitation may…
CVE-2020-9209, published 2021-01-13. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. There is a privilege escalation vulnerability in SMC2.0 product. Some files in a directory of a module are located improperly. It does not apply the directory limitation. Attackers can exploit this…