PT-2021-14991 · Huawei · Cloudengine 7800+4

Published 2021-05-19 · Updated 2021-06-08 · CVE-2021-22362

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: CloudEngine 12800 versions V200R002C50SPC800 through V200R019C10SPC800 CloudEngine 5800 versions V200R002C50SPC800 through V200R019C10SPC800 CloudEngine 6800 versions V200R002C50SPC800 through V200R019C10SPC800 CloudEngine 7800 versions V200R002C50SPC800 through V200R019C10SPC800

Description: There is an out of bounds write vulnerability in some Huawei products. An attacker can exploit this vulnerability by sending crafted data in the packet to the target device. Due to insufficient validation of message, successful exploit can cause certain service abnormal.

Recommendations: For CloudEngine 12800 versions V200R002C50SPC800 through V200R019C10SPC800, update to a version that includes the fix for this vulnerability. For CloudEngine 5800 versions V200R002C50SPC800 through V200R019C10SPC800, update to a version that includes the fix for this vulnerability. For CloudEngine 6800 versions V200R002C50SPC800 through V200R019C10SPC800, update to a version that includes the fix for this vulnerability. For CloudEngine 7800 versions V200R002C50SPC800 through V200R019C10SPC800, update to a version that includes the fix for this vulnerability. As a temporary workaround, consider restricting access to the vulnerable devices to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-22362

Affected Products

Cloudengine 12800

Cloudengine 5800

Cloudengine 6800

Cloudengine 7800

Huawei Vrp

References · 4

• https://osv.dev/vulnerability/CVE-2021-22362 · Vendor Advisory
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20210519-01-cloudengine-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22362 · Security Note
• https://t.me/cvenotify/15794 · Telegram Post