What’s Vulnerable › Vulnerabilities
CVE-2020-36602
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2022-09-20 · updated 2026-06-17
- Weakness: CWE-125
Description
There is an out-of-bounds read and write vulnerability in some headset products. An unauthenticated attacker gets the device physically and crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message, which may be exploited to cause out-of-bounds read and write.
Affected products
- Huawei 576Up005 Hota-Cm-H-Shark-Bd Firmware: 1.0.0.576
- Huawei 577Hota-Cm-H-Shark-Bd Firmware: 1.0.0.577
- Huawei 581Up-Hota-Cm-H-Shark-Bd Firmware: 1.0.0.581
- Huawei 586-Hota-Cm-H-Shark-Bd Firmware: 1.0.0.586
- Huawei 588-Hota-Cm-H-Shark-Bd Firmware: 1.0.0.588
- Huawei 606-Hota-Cm-H-Shark-Bd Firmware: 1.0.0.606
- Huawei Bi-Acc-Report Firmware: 1.0.0.1, 1.0.0.2, 1.0.0.3, 1.0.0.4, 1.0.0.5
- Huawei Cm-H-Shark-Bd Firmware: 1.0.0.66(vn2-sp11), 1.0.0.66(vn2-sp15), 1.0.0.66(vn2-sp17), 1.0.0.66(vn2-sp21), 1.0.0.66(vn2-sp27), 1.0.0.66(vn2-sp29) (+28)
References
- https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220826-01-outofboundread-en
- https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220826-01-outofboundread-en
Get alerted when CVE-2020-36602 or the next vulnerability affects your stack