Strix
26.1K

CVE-2012-6570

UnknownEPSS 1.67%

Last modified

CVE-2012-6570 is a vulnerability of currently unknown severity. The HTTP module in the (1) Branch Intelligent Management System (BIMS) and (2) web management components on Huawei AR routers and S2000, S3000, S3500, S3900, S5100, S5600, S7800, and S8500 switches does not check whether HTTP data is longer than the value of the Content-Length field, which allows remote HTTP servers to conduct heap-based buffer overflow attacks and execute arbitrary code via a crafted response.. EPSS estimates a 1.67% chance of exploitation in the next 30 days.

Description

The HTTP module in the (1) Branch Intelligent Management System (BIMS) and (2) web management components on Huawei AR routers and S2000, S3000, S3500, S3900, S5100, S5600, S7800, and S8500 switches does not check whether HTTP data is longer than the value of the Content-Length field, which allows remote HTTP servers to conduct heap-based buffer overflow attacks and execute arbitrary code via a crafted response.

Metrics

EPSS Probability
1.67%

73.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
HuaweiAr 18-1x<= r0130
HuaweiAr 18-2x<= r1712
HuaweiAr 18-3x<= r0118
HuaweiAr 19\/29\/49<= r2207
HuaweiAr 28\/46<= r0311
HuaweiS2000r6305
HuaweiS2300r6305
HuaweiS2700r6305
HuaweiS3000r6305
HuaweiS3300r6305
HuaweiS3300hir6305
HuaweiS3500r6305
HuaweiS3700r6305
HuaweiS3900r6305
HuaweiS5100r6305
HuaweiS5600r6305
HuaweiS7800r6305
HuaweiS8500r1631
HuaweiS8500r1632

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2012-6570?
The HTTP module in the (1) Branch Intelligent Management System (BIMS) and (2) web management components on Huawei AR routers and S2000, S3000, S3500, S3900, S5100, S5600, S7800, and S8500 switches does not check whether HTTP data is longer than the value of the Content-Length field, which allows remote HTTP servers to conduct heap-based buffer overflow attacks and execute arbitrary code via a crafted response.
How severe is CVE-2012-6570?
Severity scoring for CVE-2012-6570 is pending analysis. The EPSS model estimates a 1.67% probability of exploitation in the next 30 days.
How do I fix CVE-2012-6570?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2012

View all 2012CVEs →

Are you affected by CVE-2012-6570?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST