TI-2017-11254 Aliases CVE-2017-15341 GHSA-h698-9r6p-x6xw

Improper certificate validation in Huawei AR3200,TE40,TE50,TE60

LOW 34CWE-295Published 2018-02-15 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-295.

Summary

Huawei AR3200 V200R008C20, V200R008C30, TE40 V600R006C00, TE50 V600R006C00, TE60 V600R006C00 have a denial of service vulnerability. The software decodes X.509 certificate in an improper way. A remote unauthenticated attacker could send a crafted X.509 certificate to the device. Successful exploit could result in a denial of service on the device.

Why it matters now

EPSS 0.00759 55th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Huawei	AR3200,TE40,TE50,TE60	AR3200 V200R008C20, V200R008C30, TE40 V600R006C00, TE50 V600R006C00, TE60 V600R006C00	—	No fix listed	CNA

AR3200,TE40,TE50,TE60 VendorHuawei Affected AR3200 V200R008C20, V200R008C30, TE40 V600R006C00, TE50 V600R006C00, TE60 V600R006C00 Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPE	Versions	Role	Vendor
cpe:2.3:o:huawei:ar3200_firmware:v200r008c20:::::::*	v200r008c20	Vulnerable	Huawei
cpe:2.3:o:huawei:ar3200_firmware:v200r008c30:::::::*	v200r008c30	Vulnerable	Huawei
cpe:2.3:h:huawei:ar3200:-:::::::*	not specified by NVD	Running on	Huawei
cpe:2.3:o:huawei:te40_firmware:v600r006c00:::::::*	v600r006c00	Vulnerable	Huawei
cpe:2.3:h:huawei:te40:-:::::::*	not specified by NVD	Running on	Huawei
cpe:2.3:o:huawei:te50_firmware:v600r006c00:::::::*	v600r006c00	Vulnerable	Huawei
cpe:2.3:h:huawei:te50:-:::::::*	not specified by NVD	Running on	Huawei
cpe:2.3:o:huawei:te60_firmware:v600r006c00:::::::*	v600r006c00	Vulnerable	Huawei
cpe:2.3:h:huawei:te60:-:::::::*	not specified by NVD	Running on	Huawei

cpe:2.3:o:huawei:ar3200_firmware:v200r008c20:*:*:*:*:*:*:* Versions v200r008c20 Vulnerable ·Huawei
cpe:2.3:o:huawei:ar3200_firmware:v200r008c30:*:*:*:*:*:*:* Versions v200r008c30 Vulnerable ·Huawei
cpe:2.3:h:huawei:ar3200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
cpe:2.3:o:huawei:te40_firmware:v600r006c00:*:*:*:*:*:*:* Versions v600r006c00 Vulnerable ·Huawei
cpe:2.3:h:huawei:te40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
cpe:2.3:o:huawei:te50_firmware:v600r006c00:*:*:*:*:*:*:* Versions v600r006c00 Vulnerable ·Huawei
cpe:2.3:h:huawei:te50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
cpe:2.3:o:huawei:te60_firmware:v600r006c00:*:*:*:*:*:*:* Versions v600r006c00 Vulnerable ·Huawei
cpe:2.3:h:huawei:te60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2017-15341
2026-10-03 Alias added: GHSA-h698-9r6p-x6xw

References

Advisory 1

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171129-01-cert-en

TI-2016-05323 Huawei AR3200 routers with software before V200R007C00SPC600 allow remote attackers to… CVSS 3.0CRITICAL 9.8
TI-2020-07281 Improper authentication in Huawei AR3200 CVSS 3.1CRITICAL 9.8
TI-2017-12675 Improper certificate validation in Huawei… CVSS 3.0CRITICAL 9.8
TI-2017-11257 Integer overflow in Huawei AR3200 CVSS 3.0HIGH 7.5
TI-2017-11256 Integer overflow in Huawei AR3200 CVSS 3.0HIGH 7.5
TI-2017-11230 Out-of-bounds read in Huawei AR120-S CVSS 3.0HIGH 7.5

See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences