CVE-2016-6669

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-09-22 · updated 2026-06-17
Weakness: CWE-119

Description

Buffer overflow in the Authentication, Authorization and Accounting (AAA) module in Huawei USG2100, USG2200, USG5100, and USG5500 unified security gateways with software before V300R001C10SPC600 allows remote authenticated RADIUS servers to execute arbitrary code by sending a crafted EAP packet.

Affected products

Huawei Usg2100 Firmware: through v300r001c00; through v300r001c10
Huawei Usg2200 Firmware: through v300r001c00; through v300r001c10
Huawei Usg5100 Firmware: through v300r001c00; through v300r001c10
USG5500 V300R001C00 and V300R001C00: through v300r001c00; through v300r001c10

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160810-01-usg-en
http://www.securityfocus.com/bid/92441
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160810-01-usg-en
http://www.securityfocus.com/bid/92441

Get alerted when CVE-2016-6669 or the next vulnerability affects your stack