Lucene search

HuaweiCVE-2021-22365

HistoryJun 22, 2021 - 6:15 p.m.

CVE-2021-22365

2021-06-2218:15:08

CWE-125

huawei

web.nvd.nist.gov

cve-2021-22365

ese620x

vess

v100r001c10spc200

v100r001c20spc200

v200r001c00spc300

out of bounds read

vulnerability

local attacker

exploit

nvd

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

There is an out of bounds read vulnerability in eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300. A local attacker can exploit this vulnerability by sending specific message to the target device. Due to insufficient validation of internal message, successful exploit may cause the process and the service abnormal.

Affected configurations

Nvd

Vulners

Node

huaweiese620x_vess_firmwareMatchv100r001c10spc200

huaweiese620x_vess_firmwareMatchv100r001c20spc200

huaweiese620x_vess_firmwareMatchv200r001c00spc300

AND

huaweiese620x_vessMatch-

VendorProductVersionCPE
huaweiese620x_vess_firmwarev100r001c10spc200cpe:2.3:o:huawei:ese620x_vess_firmware:v100r001c10spc200:*:*:*:*:*:*:*
huaweiese620x_vess_firmwarev100r001c20spc200cpe:2.3:o:huawei:ese620x_vess_firmware:v100r001c20spc200:*:*:*:*:*:*:*
huaweiese620x_vess_firmwarev200r001c00spc300cpe:2.3:o:huawei:ese620x_vess_firmware:v200r001c00spc300:*:*:*:*:*:*:*
huaweiese620x_vess-cpe:2.3:h:huawei:ese620x_vess:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	ese620x_vess_firmware	v100r001c10spc200	cpe:2.3:o:huawei:ese620x_vess_firmware:v100r001c10spc200:::::::*
huawei	ese620x_vess_firmware	v100r001c20spc200	cpe:2.3:o:huawei:ese620x_vess_firmware:v100r001c20spc200:::::::*
huawei	ese620x_vess_firmware	v200r001c00spc300	cpe:2.3:o:huawei:ese620x_vess_firmware:v200r001c00spc300:::::::*
huawei	ese620x_vess	-	cpe:2.3:h:huawei:ese620x_vess:-:::::::*

CNA Affected

[
  {
    "product": "eSE620X vESS",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "V100R001C10SPC200,V100R001C20SPC200,V200R001C00SPC300"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20210526-02-outbounds-en

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2021-22365