TI-2017-12577 Aliases CVE-2017-17133 GHSA-3689-2458-gmcv

NULL pointer dereference in Huawei VP9660

LOW 24CWE-476Published 2018-03-05 · Updated 2024-09-16

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-476.

Summary

Huawei VP9660 V500R002C10 has a null pointer reference vulnerability in license module due to insufficient verification. An authenticated local attacker could place a malicious license file into system which cause memory null pointer accessing and related processing crash. The attacker can exploit this vulnerability to cause a denial of service.

Why it matters now

EPSS 0.00207 10th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Huawei	VP9660	V500R002C10	—	No fix listed	CNA

VP9660 VendorHuawei Affected V500R002C10 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:huawei:vp9660_firmware:v500r002c10:::::::*	v500r002c10	Vulnerable	Huawei
cpe:2.3:h:huawei:vp9660:-:::::::*	not specified by NVD	Running on	Huawei

cpe:2.3:o:huawei:vp9660_firmware:v500r002c10:*:*:*:*:*:*:* Versions v500r002c10 Vulnerable ·Huawei
cpe:2.3:h:huawei:vp9660:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2017-17133
2026-10-03 Alias added: GHSA-3689-2458-gmcv

References

Advisory 1

http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171206-01-license-en

TI-2017-12675 Improper certificate validation in Huawei… CVSS 3.0CRITICAL 9.8
TI-2019-14007 Memory corruption in Huawei AR120-S CVSS 3.1HIGH 7.5
TI-2019-14006 Memory corruption in Huawei AR120-S CVSS 3.1HIGH 7.5
TI-2019-14005 Memory corruption in Huawei AR120-S CVSS 3.1HIGH 7.5
TI-2019-03667 There is a use of insufficiently random values vulnerability in Huawei ViewPoint products. CVSS 3.1HIGH 7.5
TI-2017-12652 Improper input validation in Huawei AR120-S, AR1200, AR1200-S, AR150, AR150-S, AR160… CVSS 3.0HIGH 7.5

See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences