CVE-2020-36602

moderate-risk

Published 2022-09-20

There is an out-of-bounds read and write vulnerability in some headset products. An unauthenticated attacker gets the device physically and crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message, which may be exploited to cause out-of-bounds read and write.

Do I need to act?

0.07% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.1/10 Medium

PHYSICAL / LOW complexity

Affected Products (20)

576Up005 Hota-Cm-H-Shark-Bd Firmware

577Hota-Cm-H-Shark-Bd Firmware

581Up-Hota-Cm-H-Shark-Bd Firmware

586-Hota-Cm-H-Shark-Bd Firmware

588-Hota-Cm-H-Shark-Bd Firmware

606-Hota-Cm-H-Shark-Bd Firmware

Bi-Acc-Report Firmware

Cm-H-Shark-Bd Firmware

Affected Vendors

Huawei

References (2)

Vendor Advisory https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220826-01-outofb...

/ 100

moderate-risk

Severity 20/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 25/34 · High