Out-of-bounds read in 576up005…
Priority LOW 29CWE-125Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
There is an out-of-bounds read and write vulnerability in some headset products. An unauthenticated attacker gets the device physically and crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message, which may be exploited to cause out-of-bounds read and write.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0028 20th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | 576up005 HOTA-CM-H-Shark-BD;577HOTA-CM-H-Shark-BD;581up-HOTA-CM-H-Shark-BD;586-HOTA-CM-H-Shark-BD;588-HOTA-CM-H-Shark-BD;606-HOTA-CM-H-Shark-BD;BI-ACC-REPORT;CM-H-Shark-BD | 1.0.0.576-fullpackage; 1.0.0.577-fullpackage; 1.0.0.581-fullpackage; 1.0.0.586-fullpackage; 1.0.0.588-fullpackage; 1.0.0.606-fullpackage; 1.0.0.1,1.0.0.2,1.0.0.3,1.0.0.4,1.0.0.5; 1.0.0.106,1.0.0.116,1.0.0.202,1.0.0.208,1.0.0.216,1.0.0.226,1.0.0.228,1.0.0.510,1.0.0.520,1.0.0.522,1.0.0.566,1.0.0.576,1.0.0.578,1.0.0.586,1.0.0.588,1.0.0.66(VN2-SP11),1.0.0.66(VN2-SP15),1.0.0.66(VN2-SP17),1.0.0.66(VN2-SP21),1.0.0.66(VN2-SP27),1.0.0.66(VN2-SP29),1.0.0.66(VN2-SP31),1.0.0.66(VN2-SP33),1.9.0.208,1.9.0.216,1.9.0.226,1.9.0.228,1.9.0.510,1.9.0.520,1.9.0.522,1.9.0.566,1.9.0.578,1.9.0.586,1.9.0.588 | — | No fix listed | CNA |
- 576up005 HOTA-CM-H-Shark-BD;577HOTA-CM-H-Shark-BD;581up-HOTA-CM-H-Shark-BD;586-HOTA-CM-H-Shark-BD;588-HOTA-CM-H-Shark-BD;606-HOTA-CM-H-Shark-BD;BI-ACC-REPORT;CM-H-Shark-BD Vendor— Affected 1.0.0.576-fullpackage; 1.0.0.577-fullpackage; 1.0.0.581-fullpackage; 1.0.0.586-fullpackage; 1.0.0.588-fullpackage; 1.0.0.606-fullpackage; 1.0.0.1,1.0.0.2,1.0.0.3,1.0.0.4,1.0.0.5; 1.0.0.106,1.0.0.116,1.0.0.202,1.0.0.208,1.0.0.216,1.0.0.226,1.0.0.228,1.0.0.510,1.0.0.520,1.0.0.522,1.0.0.566,1.0.0.576,1.0.0.578,1.0.0.586,1.0.0.588,1.0.0.66(VN2-SP11),1.0.0.66(VN2-SP15),1.0.0.66(VN2-SP17),1.0.0.66(VN2-SP21),1.0.0.66(VN2-SP27),1.0.0.66(VN2-SP29),1.0.0.66(VN2-SP31),1.0.0.66(VN2-SP33),1.9.0.208,1.9.0.216,1.9.0.226,1.9.0.228,1.9.0.510,1.9.0.520,1.9.0.522,1.9.0.566,1.9.0.578,1.9.0.586,1.9.0.588 Fixed in — No fix listed CNA
CPE configurations NVD · 53
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:576up005_hota-cm-h-shark-bd_firmware:1.0.0.576:*:*:*:*:*:*:* | 1.0.0.576 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:576up005_hota-cm-h-shark-bd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:577hota-cm-h-shark-bd_firmware:1.0.0.577:*:*:*:*:*:*:* | 1.0.0.577 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:577hota-cm-h-shark-bd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:581up-hota-cm-h-shark-bd_firmware:1.0.0.581:*:*:*:*:*:*:* | 1.0.0.581 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:581up-hota-cm-h-shark-bd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:586-hota-cm-h-shark-bd_firmware:1.0.0.586:*:*:*:*:*:*:* | 1.0.0.586 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:586-hota-cm-h-shark-bd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:588-hota-cm-h-shark-bd_firmware:1.0.0.588:*:*:*:*:*:*:* | 1.0.0.588 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:588-hota-cm-h-shark-bd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:huawei:576up005_hota-cm-h-shark-bd_firmware:1.0.0.576:*:*:*:*:*:*:* Versions 1.0.0.576 Vulnerable ·Huawei
- cpe:2.3:h:huawei:576up005_hota-cm-h-shark-bd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:577hota-cm-h-shark-bd_firmware:1.0.0.577:*:*:*:*:*:*:* Versions 1.0.0.577 Vulnerable ·Huawei
- cpe:2.3:h:huawei:577hota-cm-h-shark-bd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:581up-hota-cm-h-shark-bd_firmware:1.0.0.581:*:*:*:*:*:*:* Versions 1.0.0.581 Vulnerable ·Huawei
- cpe:2.3:h:huawei:581up-hota-cm-h-shark-bd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:586-hota-cm-h-shark-bd_firmware:1.0.0.586:*:*:*:*:*:*:* Versions 1.0.0.586 Vulnerable ·Huawei
- cpe:2.3:h:huawei:586-hota-cm-h-shark-bd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:588-hota-cm-h-shark-bd_firmware:1.0.0.588:*:*:*:*:*:*:* Versions 1.0.0.588 Vulnerable ·Huawei
- cpe:2.3:h:huawei:588-hota-cm-h-shark-bd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Show 43 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:606-hota-cm-h-shark-bd_firmware:1.0.0.606:*:*:*:*:*:*:* | 1.0.0.606 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:606-hota-cm-h-shark-bd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:bi-acc-report_firmware:1.0.0.1:*:*:*:*:*:*:* | 1.0.0.1 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:bi-acc-report_firmware:1.0.0.2:*:*:*:*:*:*:* | 1.0.0.2 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:bi-acc-report_firmware:1.0.0.3:*:*:*:*:*:*:* | 1.0.0.3 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:bi-acc-report_firmware:1.0.0.4:*:*:*:*:*:*:* | 1.0.0.4 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:bi-acc-report_firmware:1.0.0.5:*:*:*:*:*:*:* | 1.0.0.5 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:bi-acc-report:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.66\(vn2-sp11\):*:*:*:*:*:*:* | 1.0.0.66(vn2-sp11) | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.66\(vn2-sp15\):*:*:*:*:*:*:* | 1.0.0.66(vn2-sp15) | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.66\(vn2-sp17\):*:*:*:*:*:*:* | 1.0.0.66(vn2-sp17) | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.66\(vn2-sp21\):*:*:*:*:*:*:* | 1.0.0.66(vn2-sp21) | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.66\(vn2-sp27\):*:*:*:*:*:*:* | 1.0.0.66(vn2-sp27) | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.66\(vn2-sp29\):*:*:*:*:*:*:* | 1.0.0.66(vn2-sp29) | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.66\(vn2-sp31\):*:*:*:*:*:*:* | 1.0.0.66(vn2-sp31) | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.66\(vn2-sp33\):*:*:*:*:*:*:* | 1.0.0.66(vn2-sp33) | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.106:*:*:*:*:*:*:* | 1.0.0.106 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.116:*:*:*:*:*:*:* | 1.0.0.116 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.202:*:*:*:*:*:*:* | 1.0.0.202 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.208:*:*:*:*:*:*:* | 1.0.0.208 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.216:*:*:*:*:*:*:* | 1.0.0.216 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.226:*:*:*:*:*:*:* | 1.0.0.226 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.228:*:*:*:*:*:*:* | 1.0.0.228 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.510:*:*:*:*:*:*:* | 1.0.0.510 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.520:*:*:*:*:*:*:* | 1.0.0.520 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.522:*:*:*:*:*:*:* | 1.0.0.522 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.566:*:*:*:*:*:*:* | 1.0.0.566 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.576:*:*:*:*:*:*:* | 1.0.0.576 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.578:*:*:*:*:*:*:* | 1.0.0.578 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.586:*:*:*:*:*:*:* | 1.0.0.586 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.588:*:*:*:*:*:*:* | 1.0.0.588 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.208:*:*:*:*:*:*:* | 1.9.0.208 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.216:*:*:*:*:*:*:* | 1.9.0.216 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.226:*:*:*:*:*:*:* | 1.9.0.226 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.228:*:*:*:*:*:*:* | 1.9.0.228 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.510:*:*:*:*:*:*:* | 1.9.0.510 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.520:*:*:*:*:*:*:* | 1.9.0.520 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.522:*:*:*:*:*:*:* | 1.9.0.522 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.566:*:*:*:*:*:*:* | 1.9.0.566 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.578:*:*:*:*:*:*:* | 1.9.0.578 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.586:*:*:*:*:*:*:* | 1.9.0.586 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.588:*:*:*:*:*:*:* | 1.9.0.588 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:cm-h-shark-bd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:huawei:606-hota-cm-h-shark-bd_firmware:1.0.0.606:*:*:*:*:*:*:* Versions 1.0.0.606 Vulnerable ·Huawei
- cpe:2.3:h:huawei:606-hota-cm-h-shark-bd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:bi-acc-report_firmware:1.0.0.1:*:*:*:*:*:*:* Versions 1.0.0.1 Vulnerable ·Huawei
- cpe:2.3:o:huawei:bi-acc-report_firmware:1.0.0.2:*:*:*:*:*:*:* Versions 1.0.0.2 Vulnerable ·Huawei
- cpe:2.3:o:huawei:bi-acc-report_firmware:1.0.0.3:*:*:*:*:*:*:* Versions 1.0.0.3 Vulnerable ·Huawei
- cpe:2.3:o:huawei:bi-acc-report_firmware:1.0.0.4:*:*:*:*:*:*:* Versions 1.0.0.4 Vulnerable ·Huawei
- cpe:2.3:o:huawei:bi-acc-report_firmware:1.0.0.5:*:*:*:*:*:*:* Versions 1.0.0.5 Vulnerable ·Huawei
- cpe:2.3:h:huawei:bi-acc-report:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.66\(vn2-sp11\):*:*:*:*:*:*:* Versions 1.0.0.66(vn2-sp11) Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.66\(vn2-sp15\):*:*:*:*:*:*:* Versions 1.0.0.66(vn2-sp15) Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.66\(vn2-sp17\):*:*:*:*:*:*:* Versions 1.0.0.66(vn2-sp17) Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.66\(vn2-sp21\):*:*:*:*:*:*:* Versions 1.0.0.66(vn2-sp21) Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.66\(vn2-sp27\):*:*:*:*:*:*:* Versions 1.0.0.66(vn2-sp27) Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.66\(vn2-sp29\):*:*:*:*:*:*:* Versions 1.0.0.66(vn2-sp29) Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.66\(vn2-sp31\):*:*:*:*:*:*:* Versions 1.0.0.66(vn2-sp31) Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.66\(vn2-sp33\):*:*:*:*:*:*:* Versions 1.0.0.66(vn2-sp33) Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.106:*:*:*:*:*:*:* Versions 1.0.0.106 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.116:*:*:*:*:*:*:* Versions 1.0.0.116 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.202:*:*:*:*:*:*:* Versions 1.0.0.202 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.208:*:*:*:*:*:*:* Versions 1.0.0.208 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.216:*:*:*:*:*:*:* Versions 1.0.0.216 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.226:*:*:*:*:*:*:* Versions 1.0.0.226 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.228:*:*:*:*:*:*:* Versions 1.0.0.228 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.510:*:*:*:*:*:*:* Versions 1.0.0.510 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.520:*:*:*:*:*:*:* Versions 1.0.0.520 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.522:*:*:*:*:*:*:* Versions 1.0.0.522 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.566:*:*:*:*:*:*:* Versions 1.0.0.566 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.576:*:*:*:*:*:*:* Versions 1.0.0.576 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.578:*:*:*:*:*:*:* Versions 1.0.0.578 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.586:*:*:*:*:*:*:* Versions 1.0.0.586 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.0.0.588:*:*:*:*:*:*:* Versions 1.0.0.588 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.208:*:*:*:*:*:*:* Versions 1.9.0.208 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.216:*:*:*:*:*:*:* Versions 1.9.0.216 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.226:*:*:*:*:*:*:* Versions 1.9.0.226 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.228:*:*:*:*:*:*:* Versions 1.9.0.228 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.510:*:*:*:*:*:*:* Versions 1.9.0.510 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.520:*:*:*:*:*:*:* Versions 1.9.0.520 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.522:*:*:*:*:*:*:* Versions 1.9.0.522 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.566:*:*:*:*:*:*:* Versions 1.9.0.566 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.578:*:*:*:*:*:*:* Versions 1.9.0.578 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.586:*:*:*:*:*:*:* Versions 1.9.0.586 Vulnerable ·Huawei
- cpe:2.3:o:huawei:cm-h-shark-bd_firmware:1.9.0.588:*:*:*:*:*:*:* Versions 1.9.0.588 Vulnerable ·Huawei
- cpe:2.3:h:huawei:cm-h-shark-bd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-36602
- 2026-10-03 Alias added: GHSA-cq9m-rh8p-vchf
References
Sources
- CVE-2020-36602 · CVE Program
- CVE-2020-36602 · NVD
- FIRST EPSS
- GHSA-cq9m-rh8p-vchf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences