CVE-2020-9099

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-08 · updated 2026-06-17
Weakness: CWE-287

Description

Huawei products IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospace USG6300; Secospace USG6500; Secospace USG6600; USG9500 with versions of V500R001C00; V500R001C20; V500R001C30; V500R001C50; V500R001C60; V500R001C80; V500R005C00; V500R005C10; V500R005C20; V500R002C00; V500R002C10; V500R002C20; V500R002C30 have an improper authentication vulnerability. Attackers need to perform some operations to exploit the vulnerability. Successful exploit may obtain certain permissions on the device.

Affected products

Huawei Ips Module Firmware: v500r001c00, v500r001c20, v500r001c30, v500r001c50, v500r001c60, v500r001c80 (+3)
Huawei Ngfw Module Firmware: v500r001c00, v500r001c20, v500r001c30, v500r001c50, v500r001c60, v500r002c00 (+6)
Huawei Nip6300 Firmware: v500r001c00, v500r001c20, v500r001c30, v500r001c50, v500r001c60, v500r001c80 (+3)
Huawei Nip6600 Firmware: v500r001c00, v500r001c20, v500r001c30, v500r001c50, v500r001c60, v500r001c80 (+3)
Huawei Nip6800 Firmware: v500r001c60, v500r001c80, v500r005c00, v500r005c10, v500r005c20
Huawei Secospace Usg6300 Firmware: v500r001c00, v500r001c20, v500r001c30, v500r001c50, v500r001c60, v500r001c80 (+3)
Huawei Secospace Usg6500 Firmware: v500r001c00, v500r001c20, v500r001c30, v500r001c50, v500r001c60, v500r001c80 (+3)
Huawei Technologies Co., Ltd. Secospace USG6600: v500r001c00, v500r001c20, v500r001c30, v500r001c50, v500r001c60, v500r001c80 (+3)
Huawei USG9500: v500r001c00, v500r001c20, v500r001c30, v500r001c50, v500r001c60, v500r001c80 (+3)

References

Get alerted when CVE-2020-9099 or the next vulnerability affects your stack