PT-2021-21466 · Huawei · Ecns280 Td+2

Published 2021-08-18 · Updated 2021-11-24 · CVE-2021-37036

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FusionCompute version 6.5.1 eCNS280 TD versions V100R005C00 through V100R005C10

Description The issue is related to improper storage of specific information in log files. When a user logs in to the device, an attacker can obtain this information, potentially leading to information leakage. This occurs due to a flaw in how certain data is handled during the login process.

Recommendations For FusionCompute version 6.5.1, update the logging mechanism to properly secure sensitive information. For eCNS280 TD versions V100R005C00 through V100R005C10, modify the log file storage to prevent unauthorized access to sensitive data.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2021-37036

Affected Products

Fusioncompute

Huawei Vrp

Ecns280 Td

References · 3

• https://huawei.com/en/psirt/security-advisories/huawei-sa-20210818-01-informationleak-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37036 · Security Note