PT-2021-20335 · Ee · 4Gee Router Hh70Vb

Guan Yu Lai + 2 · Published 2021-06-18 · Updated 2021-06-24 · CVE-2021-33822

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: 4GEE ROUTER HH70VB version HH70 E1 02.00 22

Description: An issue allows attackers to send incomplete HTTP requests using tools like slowhttptest, causing the server to wait for the packet to finish the connection until its resources are exhausted, resulting in a denial-of-service.

Recommendations: For version HH70 E1 02.00 22, consider restricting access to the web server or implementing rate limiting to minimize the risk of exploitation. As a temporary workaround, restrict the use of HTTP requests that can cause the server to wait indefinitely for a packet to finish the connection.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-33822

Affected Products

4Gee Router Hh70Vb

References · 6

• 🔥 https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2021-33822.md · Exploit
• https://sing4g.com/product-page/4gee-router-hh70vb-4g-300mbps-2lan-32wifi · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33822 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33822 · Vendor Advisory
• https://github.com/shekyan/slowhttptest · Note
• https://t.me/cvenotify/16552 · Telegram Post