Lucene search

[email protected]CVE-2021-22310

HistoryMar 22, 2021 - 7:15 p.m.

CVE-2021-22310

2021-03-2219:15:11

CWE-532

[email protected]

web.nvd.nist.gov

cve-2021-22310

information leakage

huawei products

log file

exploit

nip6300

nip6600

secospace usg6300

usg6500

usg6600

usg9500

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

4.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

There is an information leakage vulnerability in some huawei products. Due to the properly storage of specific information in the log file, the attacker can obtain the information when a user logs in to the device. Successful exploit may cause an information leak. Affected product versions include: NIP6300 versions V500R001C00,V500R001C20,V500R001C30;NIP6600 versions V500R001C00,V500R001C20,V500R001C30;Secospace USG6300 versions V500R001C00,V500R001C20,V500R001C30;Secospace USG6500 versions V500R001C00,V500R001C20,V500R001C30;Secospace USG6600 versions V500R001C00,V500R001C20,V500R001C30,V500R001C50,V500R001C60,V500R001C80;USG9500 versions V500R005C00,V500R005C10.

Affected configurations

NVD

Node

huaweinip6300_firmwareMatchv500r001c00

huaweinip6300_firmwareMatchv500r001c20

huaweinip6300_firmwareMatchv500r001c30

AND

huaweinip6300Match-

Node

huaweinip6600_firmwareMatchv500r001c00

huaweinip6600_firmwareMatchv500r001c20

huaweinip6600_firmwareMatchv500r001c30

AND

huaweinip6600Match-

Node

huaweisecospace_usg6300_firmwareMatchv500r001c00

huaweisecospace_usg6300_firmwareMatchv500r001c20

huaweisecospace_usg6300_firmwareMatchv500r001c30

AND

huaweisecospace_usg6300Match-

Node

huaweisecospace_usg6500_firmwareMatchv500r001c00

huaweisecospace_usg6500_firmwareMatchv500r001c20

huaweisecospace_usg6500_firmwareMatchv500r001c30

AND

huaweisecospace_usg6500Match-

Node

huaweisecospace_usg6600Match-

AND

huaweisecospace_usg6600_firmwareMatchv500r001c00

huaweisecospace_usg6600_firmwareMatchv500r001c20

huaweisecospace_usg6600_firmwareMatchv500r001c30

huaweisecospace_usg6600_firmwareMatchv500r001c50

huaweisecospace_usg6600_firmwareMatchv500r001c60

huaweisecospace_usg6600_firmwareMatchv500r001c80

Node

huaweiusg9500Match-

AND

huaweiusg9500_firmwareMatchv500r005c00

huaweiusg9500_firmwareMatchv500r005c10

CPENameOperatorVersion
huawei:nip6300_firmwarehuawei nip6300 firmwareeqv500r001c00
huawei:nip6300_firmwarehuawei nip6300 firmwareeqv500r001c20
huawei:nip6300_firmwarehuawei nip6300 firmwareeqv500r001c30

CPE	Name	Operator	Version
huawei:nip6300_firmware	huawei nip6300 firmware	eq	v500r001c00
huawei:nip6300_firmware	huawei nip6300 firmware	eq	v500r001c20
huawei:nip6300_firmware	huawei nip6300 firmware	eq	v500r001c30

CNA Affected

[
  {
    "product": "NIP6300;NIP6600;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG9500",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "V500R001C00,V500R001C20,V500R001C30"
      },
      {
        "status": "affected",
        "version": "V500R001C00,V500R001C20,V500R001C30,V500R001C50,V500R001C60,V500R001C80"
      },
      {
        "status": "affected",
        "version": "V500R005C00,V500R005C10"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20210203-01-plaintextlog-en

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

4.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

Related for CVE-2021-22310

prion1 cvelist1 huawei1 openvas1 nvd1