{"id":"CVE-2019-5300","aliases":["EUVD-2019-14905","GHSA-mhr8-vxv5-m5v8"],"status":"published","title":"There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160,...","description":"There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR2200-S, AR3200, SRG1300, SRG2300 and SRG3300 Huawei routers. The vulnerability is due to the affected software improperly verifying digital signatures for the software image in the affected device. A local attacker with high privilege may exploit the vulnerability to bypass integrity checks for software images and install a malicious software image on the affected device.","severity":{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00186,"percentile":0.08245,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-347"],"published":"2019-06-04T18:30:58Z","modified":"2026-06-17T02:37:28Z","products":[{"vendor":"huawei","product":"ar1200, ar1200-s, ar150, ar160, ar200, ar2200, ar2200-s, ar3200, srg1300, srg2300, srg3300"},{"vendor":"huawei","product":"ar1200-s_firmware"},{"vendor":"huawei","product":"ar1200_firmware"},{"vendor":"huawei","product":"ar150_firmware"},{"vendor":"huawei","product":"ar160_firmware"},{"vendor":"huawei","product":"ar200_firmware"},{"vendor":"huawei","product":"ar2200_firmware"},{"vendor":"huawei","product":"ar2200s_firmware"},{"vendor":"huawei","product":"ar3200_firmware"},{"vendor":"huawei","product":"srg1300_firmware"},{"vendor":"huawei","product":"srg2300_firmware"},{"vendor":"huawei","product":"srg3300_firmware"}],"references":[{"url":"https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190320-01-ar-en","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5300"},{"url":"https://github.com/advisories/GHSA-mhr8-vxv5-m5v8"}],"sources":{"cve":[{"id":"CVE-2019-5300","description":"There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR2200-S, AR3200, SRG1300, SRG2300 and SRG3300 Huawei routers. The vulnerability is due to the affected software improperly verifying digital signatures for the software image in the affected device. A local attacker with high privilege may exploit the vulnerability to bypass integrity checks for software images and install a malicious software image on the affected device.","status":"published","published":"2019-06-04T18:30:58Z","modified":"2024-08-04T19:54:52.437Z","updated_at":"2026-11-02T14:20:18.411291Z"}],"euvd":[{"id":"EUVD-2019-14905","description":"There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR2200-S, AR3200, SRG1300, SRG2300 and SRG3300 Huawei routers. The vulnerability is due to the affected software improperly verifying digital signatures for the software image in the affected device. A local attacker with high privilege may exploit the vulnerability to bypass integrity checks for software images and install a malicious software image on the affected device.","status":"published","published":"2019-06-04T18:30:58Z","modified":"2024-08-04T19:54:52Z","updated_at":"2026-11-03T03:06:52.999682Z"}],"ghsa":[{"id":"GHSA-mhr8-vxv5-m5v8","title":"There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160,...","description":"There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR2200-S, AR3200, SRG1300, SRG2300 and SRG3300 Huawei routers. The vulnerability is due to the affected software improperly verifying digital signatures for the software image in the affected device. A local attacker with high privilege may exploit the vulnerability to bypass integrity checks for software images and install a malicious software image on the affected device.","status":"published","published":"2022-05-24T16:47:10Z","modified":"2024-04-11T21:18:07Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:57:09.764736Z"}],"nvd":[{"id":"CVE-2019-5300","description":"There is a digital signature verification bypass vulnerability in AR1200, AR1200-S, AR150, AR160, AR200, AR2200, AR2200-S, AR3200, SRG1300, SRG2300 and SRG3300 Huawei routers. The vulnerability is due to the affected software improperly verifying digital signatures for the software image in the affected device. A local attacker with high privilege may exploit the vulnerability to bypass integrity checks for software images and install a malicious software image on the affected device.","status":"published","published":"2019-06-04T19:29:00.633Z","modified":"2026-06-17T02:37:28.12Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:05:16.285679Z"}]}}