CVE-2020-9127
MEDIUMHuawei NIP6300 NIP6600 Secospace USG6300 USG6500 USG6600 USG9500 Firmware - Authenticated Command Injection
Title source: llmDescription
Some Huawei products have a command injection vulnerability. Due to insufficient input validation, an attacker with high privilege may inject some malicious codes in some files of the affected products. Successful exploit may cause command injection.Affected product versions include:NIP6300 versions V500R001C30,V500R001C60;NIP6600 versions V500R001C30,V500R001C60;Secospace USG6300 versions V500R001C30,V500R001C60;Secospace USG6500 versions V500R001C30,V500R001C60;Secospace USG6600 versions V500R001C30,V500R001C60;USG9500 versions V500R001C30,V500R001C60.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_misc
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201111-02-injection-en
Scores
CVSS v3
6.7
EPSS
0.0011
EPSS Percentile
29.4%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-20
CWE-77
Status
published
Products (12)
huawei/nip6300_firmware
v500r001c30
huawei/nip6300_firmware
v500r001c60
huawei/nip6600_firmware
v500r001c30
huawei/nip6600_firmware
v500r001c60
huawei/secospace_usg6300_firmware
v500r001c30
huawei/secospace_usg6300_firmware
v500r001c60
huawei/secospace_usg6500_firmware
v500r001c30
huawei/secospace_usg6500_firmware
v500r001c60
huawei/secospace_usg6600_firmware
v500r001c30
huawei/secospace_usg6600_firmware
v500r001c60
... and 2 more
Published
Nov 13, 2020
Tracked Since
Feb 18, 2026