PT-2021-14956 · Huawei · Huawei S6700+13

Published 2021-02-10 · Updated 2021-03-24 · CVE-2021-22321

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Huawei NIP6300 (affected versions not specified) Huawei NIP6600 (affected versions not specified) Huawei NIP6800 (affected versions not specified) Huawei S1700 (affected versions not specified) Huawei S2700 (affected versions not specified) Huawei S5700 (affected versions not specified) Huawei S6700 (affected versions not specified) Huawei S7700 (affected versions not specified) Huawei S9700 (affected versions not specified) Huawei Secospace USG6300 (affected versions not specified) Huawei Secospace USG6500 (affected versions not specified) Huawei Secospace USG6600 (affected versions not specified) Huawei USG9500 (affected versions not specified)

Description: There is a use-after-free issue in a Huawei product. A module cannot handle specific operations in special scenarios, allowing attackers to exploit this by performing malicious operations, which can cause memory use-after-free and compromise normal service.

Recommendations: For Huawei NIP6300, update to a version that includes a fix for this issue. For Huawei NIP6600, update to a version that includes a fix for this issue. For Huawei NIP6800, update to a version that includes a fix for this issue. For Huawei S1700, update to a version that includes a fix for this issue. For Huawei S2700, update to a version that includes a fix for this issue. For Huawei S5700, update to a version that includes a fix for this issue. For Huawei S6700, update to a version that includes a fix for this issue. For Huawei S7700, update to a version that includes a fix for this issue. For Huawei S9700, update to a version that includes a fix for this issue. For Huawei Secospace USG6300, update to a version that includes a fix for this issue. For Huawei Secospace USG6500, update to a version that includes a fix for this issue. For Huawei Secospace USG6600, update to a version that includes a fix for this issue. For Huawei USG9500, update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2021-22321

Affected Products

Huawei Nip6300

Huawei Nip6600

Huawei Nip6800

Huawei S1700

Huawei S2700

Huawei S5700

Huawei S6700

Huawei S7700

Huawei S9700

Huawei Secospace Usg6300

Huawei Secospace Usg6500

Huawei Secospace Usg6600

Huawei Usg9500

Huawei Vrp

References · 5

• https://osv.dev/vulnerability/CVE-2021-22321 · Vendor Advisory
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20210210-01-uaf-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22321 · Security Note
• https://t.me/cvenotify/11719 · Telegram Post
• https://t.me/cibsecurity/25262 · Telegram Post