How severe is CVE-2014-4190?

CVE-2014-4190 has a CVSS 2.0 base score of 7.8, rated high severity.

Is CVE-2014-4190 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (71st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2014-4190?

CVE-2014-4190 primarily affects Huawei Campus Series Switch Software. In total, 16 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2014-4190?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2014-4190 published?

CVE-2014-4190 was published on 2014-06-17 and last updated on 2026-06-17.

CVE-2014-4190

CVE-2014-4190 is a high-severity vulnerability in Huawei Campus Series Switch Software with a CVSS 2.0 base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-119.

Key facts

Severity: High (CVSS 2.0 base score 7.8)
EPSS exploit prediction: 1% (71st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-119
Affected product: Huawei Campus Series Switch Software
Published: 2014-06-17
Last modified: 2026-06-17

Description

Multiple heap-based buffer overflows in Huawei Campus Series Switches S3700HI, S5700, S6700, S3300HI, S5300, S6300, S9300, S7700, and LSW S9700 with software V200R001 before V200R001SPH013; S5700, S6700, S5300, and S6300 with software V200R002 before V200R002SPH005; S7700, S9300, S9300E, S5300, S5700, S6300, S6700, S2350, S2750, and LSW S9700 with software V200R003 before V200R003SPH005; and S7700, S9300, S9300E, and LSW S9700 with software V200R005 before V200R005C00SPC300 allow remote attackers to cause a denial of service (device restart) via a crafted length field in a packet.

Frequently asked questions

What is CVE-2014-4190?: Multiple heap-based buffer overflows in Huawei Campus Series Switches S3700HI, S5700, S6700, S3300HI, S5300, S6300, S9300, S7700, and LSW S9700 with software V200R001 before V200R001SPH013; S5700, S6700, S5300, and S6300 with software V200R002 before V200R002SPH005; S7700, S9300, S9300E, S5300, S5700, S6300, S6700, S2350, S2750, and LSW S9700 with software V200R003 before V200R003SPH005; and S7700, S9300, S9300E, and LSW S9700 with software V200R005 before V200R005C00SPC300 allow remote attackers to cause a denial of service (device restart) via a crafted length field in a packet.
How severe is CVE-2014-4190?: CVE-2014-4190 has a CVSS 2.0 base score of 7.8, rated high severity.
Is CVE-2014-4190 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (71st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2014-4190?: CVE-2014-4190 primarily affects Huawei Campus Series Switch Software. In total, 16 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2014-4190?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2014-4190 published?: CVE-2014-4190 was published on 2014-06-17 and last updated on 2026-06-17.

References

Affected products (16)

cpe:2.3:a:huawei:campus_series_switch_software:v200r001:*:*:*:*:*:*:*
cpe:2.3:h:huawei:campus_lsw_s9700:-:*:*:*:*:*:*:*
cpe:2.3:h:huawei:campus_s3300hi:-:*:*:*:*:*:*:*
cpe:2.3:h:huawei:campus_s3700hi:-:*:*:*:*:*:*:*
cpe:2.3:h:huawei:campus_s5300:-:*:*:*:*:*:*:*
cpe:2.3:h:huawei:campus_s5700:-:*:*:*:*:*:*:*
cpe:2.3:h:huawei:campus_s6300:-:*:*:*:*:*:*:*
cpe:2.3:h:huawei:campus_s6700:-:*:*:*:*:*:*:*
cpe:2.3:h:huawei:campus_s7700:-:*:*:*:*:*:*:*
cpe:2.3:h:huawei:campus_s9300:-:*:*:*:*:*:*:*
cpe:2.3:a:huawei:campus_series_switch_software:v200r005:*:*:*:*:*:*:*
cpe:2.3:h:huawei:campus_s9300e:-:*:*:*:*:*:*:*
cpe:2.3:a:huawei:campus_series_switch_software:v200r003:*:*:*:*:*:*:*
cpe:2.3:h:huawei:campus_s2350:-:*:*:*:*:*:*:*
cpe:2.3:h:huawei:campus_s2750:-:*:*:*:*:*:*:*
cpe:2.3:a:huawei:campus_series_switch_software:v200r002:*:*:*:*:*:*:*

Other CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities

CVE-2026-2778 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in…
CVE-2026-2776 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability…
CVE-2025-1866 — Critical (CVSS 10.0): Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows…
CVE-2022-27625 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
CVE-2022-27624 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
CVE-2020-11896 — Critical (CVSS 10.0): The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

Browse all CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities →