Skip to content
Fencer Vulns
high 7.5

CVE-2019-19417 json

The SIP module of some Huawei products have a denial of service (DoS) vulnerability.

published 2020-07-08 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-9038

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the specially crafted messages to the affected device. Due to the insufficient verification of the packets, successful exploit could allow the attacker to cause buffer overflow and dead loop, leading to DoS condition. Affected products can be found in https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-sip-en.

Exploit prediction

0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • Huawei AR120-S
  • Huawei AR1200
  • Huawei AR1200-S
  • Huawei AR150
  • Huawei AR150-S
  • Huawei AR160
  • Huawei AR200
  • Huawei AR200-S
  • Huawei AR2200
  • Huawei AR2200-S
  • Huawei AR3200
  • Huawei AR3600
  • Huawei AR510
  • Huawei DP300
  • Huawei IPS Module
  • Huawei NGFW Module
  • Huawei NIP6300
  • Huawei NIP6600
  • Huawei NIP6800
  • Huawei NetEngine16EX
  • Huawei RSE6500
  • Huawei SMC2.0
  • Huawei SRG1300
  • Huawei SRG2300
  • Huawei SRG3300
  • Huawei SVN5600
  • Huawei SVN5800
  • Huawei SVN5800-C
  • Huawei SeMG9811
  • Huawei Secospace USG6300
  • Huawei Secospace USG6500
  • Huawei Secospace USG6600
  • Huawei SoftCo
  • Huawei TE30
  • Huawei TE40
  • Huawei TE50
  • Huawei TE60
  • Huawei TP3206
  • Huawei USG9500
  • Huawei USG9520
  • Huawei USG9560
  • Huawei VP9660
  • Huawei ViewPoint 8660
  • Huawei ViewPoint 9030
  • Huawei eSpace U1910
  • Huawei eSpace U1911
  • Huawei eSpace U1930
  • Huawei eSpace U1960
  • Huawei eSpace U1980
  • Huawei eSpace U1981

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.