Login Sign Up

CVE-2020-1799

7.5 HIGH
Remote Code Execution

📋 TL;DR

This is a use-after-free vulnerability in Huawei E6878-370 mobile WiFi devices that allows attackers to execute malicious code. Attackers can exploit it through crafted operations via the web portal interface. Only specific firmware versions of the E6878-370 are affected.

💻 Affected Systems

Products:
  • Huawei E6878-370 Mobile WiFi
Versions: 10.0.3.1(H557SP27C233), 10.0.3.1(H563SP1C00), 10.0.3.1(H563SP1C233)
Operating Systems: Embedded firmware
Default Config Vulnerable: ⚠️ Yes
Notes: Only these specific firmware versions are affected. Other versions and models are not vulnerable.

📦 What is this software?

E6878 370 Firmware by Huawei

View all CVEs affecting E6878 370 Firmware →

E6878 370 Firmware by Huawei

View all CVEs affecting E6878 370 Firmware →

E6878 370 Firmware by Huawei

View all CVEs affecting E6878 370 Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete device compromise, data theft, and potential lateral movement to connected networks.

🟠

Likely Case

Device crash/reboot or limited code execution allowing attacker persistence on the device.

🟢

If Mitigated

No impact if device is patched or isolated from untrusted networks.

🌐 Internet-Facing: HIGH - Web portal is typically accessible from WAN interface, making internet-facing devices vulnerable.
🏢 Internal Only: MEDIUM - Internal attackers with network access could exploit via LAN interface.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: MEDIUM

Exploitation requires crafted web portal operations but no authentication. No public exploit code is known.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after those listed in affected systems

Vendor Advisory: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200520-01-uaf-en

Restart Required: Yes

Instructions:

1. Log into device web portal. 2. Navigate to firmware update section. 3. Download latest firmware from Huawei support site. 4. Upload and apply firmware update. 5. Reboot device after update completes.

🔧 Temporary Workarounds

Disable WAN web portal access

all

Prevent external access to web portal interface

Configure firewall to block port 80/443 to device WAN IP
Disable remote management in device settings

Network segmentation

all

Isolate device to separate VLAN/network

Configure switch to place device on isolated VLAN
Implement firewall rules to restrict device communication

🧯 If You Can't Patch

  • Isolate device from internet and untrusted networks
  • Implement strict network access controls and monitor for suspicious web portal activity

🔍 How to Verify

Check if Vulnerable:

Check firmware version in device web portal under System Information or About sections

Check Version:

Not applicable - check via web portal interface

Verify Fix Applied:

Confirm firmware version is no longer in affected version list and device functions normally

📡 Detection & Monitoring

Log Indicators:

  • Multiple failed web portal access attempts
  • Unusual web portal activity patterns
  • Device crash/reboot logs

Network Indicators:

  • Unusual HTTP requests to device web portal
  • Traffic spikes to device management interface

SIEM Query:

source_ip="device_ip" AND (http_method="POST" OR http_method="PUT") AND uri CONTAINS "/cgi-bin/" AND status_code=200

📊 Metadata

CVE ID: CVE-2020-1799
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-416
Published: May 21, 2020
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-1799, you might also want to check these:

CVE-2025-24085 10.0

This CVE describes a use-after-free vulnerability (CWE-416) in Apple operating systems that allows m...

Same vulnerability type (CWE-416)
CVE-2024-43102 10.0

This CVE describes a use-after-free vulnerability in FreeBSD's umtx (user mutex) subsystem where con...

Same vulnerability type (CWE-416)
CVE-2021-33796 10.0

CVE-2021-33796 is a use-after-free vulnerability in MuJS's regexp source property access that can le...

Same vulnerability type (CWE-416)