CVE-2019-5268

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-29 · updated 2026-06-17
Weakness: CWE-20

Description

Some Huawei home routers have an input validation vulnerability. Due to input parameter is not correctly verified, an attacker can exploit this vulnerability by sending special constructed packets to obtain files in the device and upload files to some directories.

Affected products

Huawei Cd10-10 Firmware: from 10.0.2.2 before 10.0.2.7 — fixed in 10.0.2.7
Huawei Cd16-10 Firmware: from 10.0.2.3 before 10.0.2.5 — fixed in 10.0.2.5
Huawei Cd17-10 Firmware: from 9.0.3.3 before 10.0.2.5 — fixed in 10.0.2.5
Huawei Cd18-10 Firmware: from 9.0.2.23 before 10.0.2.5 — fixed in 10.0.2.5
Huawei Hirouter-Cd15-10 Firmware: from 9.0.2.3 before 10.0.2.5 — fixed in 10.0.2.5
Huawei Hirouter-Cd20-10 Firmware: from 9.0.3.9 before 10.0.2.6 — fixed in 10.0.2.6
Huawei Hirouter-Cd21-16 Firmware: from 9.0.3.9 before 10.0.2.5 — fixed in 10.0.2.5
Huawei Hirouter-Cd30-10 Firmware: from 10.0.2.8 before 10.0.2.9 — fixed in 10.0.2.9
Huawei Hirouter-Cd30-11 Firmware: from 10.0.2.8 before 10.0.2.9 — fixed in 10.0.2.9
Huawei Hirouter-H1-10 Firmware: from 9.0.3.11 before 10.0.2.5 — fixed in 10.0.2.5
Huawei Tc5200-10 Firmware: from 10.0.2.3 before 10.0.2.5 — fixed in 10.0.2.5
Huawei Ws5100-10 Firmware: from 9.0.3.11 before 10.0.2.7 — fixed in 10.0.2.7
Huawei Ws5102-10 Firmware: from 10.0.2.2 before 10.0.2.7 — fixed in 10.0.2.7
Huawei Ws5106-10 Firmware: from 10.0.2.2 before 10.0.2.7 — fixed in 10.0.2.7
Huawei Ws5108-10 Firmware: from 10.0.2.2 before 10.0.2.7 — fixed in 10.0.2.7
Huawei Ws5200-10 Firmware: from 9.0.3.9 before 10.0.2.6 — fixed in 10.0.2.6
Huawei Ws5200-11 Firmware: 9.0.3.11, 10.0.2.3
Huawei Ws5280-10 Firmware: from 9.0.3.22 before 10.0.2.6 — fixed in 10.0.2.6
Huawei Ws5280-11 Firmware: from 9.0.3.22 before 10.0.2.6 — fixed in 10.0.2.6
Huawei Ws6500-10 Firmware: from 10.0.2.3 before 10.0.2.5 — fixed in 10.0.2.5
Huawei Ws6500-11 Firmware: from 10.0.2.2 before 10.0.2.7 — fixed in 10.0.2.7
Huawei Ws826-10 Firmware: from 9.0.3.11 before 10.0.2.5 — fixed in 10.0.2.5

How to fix

Upgrade to a fixed version: Huawei Cd10-10 Firmware 10.0.2.7; Huawei Cd16-10 Firmware 10.0.2.5; Huawei Cd17-10 Firmware 10.0.2.5; Huawei Cd18-10 Firmware 10.0.2.5; Huawei Hirouter-Cd15-10 Firmware 10.0.2.5; Huawei Hirouter-Cd20-10 Firmware 10.0.2.6; Huawei Hirouter-Cd21-16 Firmware 10.0.2.5; Huawei Hirouter-Cd30-10 Firmware 10.0.2.9; Huawei Hirouter-Cd30-11 Firmware 10.0.2.9; Huawei Hirouter-H1-10 Firmware 10.0.2.5; Huawei Tc5200-10 Firmware 10.0.2.5; Huawei Ws5100-10 Firmware 10.0.2.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-5268 or the next vulnerability affects your stack