PT-2021-21522 · Huawei · Huawei P40

Published 2021-09-28 · Updated 2021-10-06 · CVE-2021-37104

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HUAWEI P40 version 10.1.0.118(C00E116R3P3)

Description The issue is due to insufficient validation of parameters while dealing with some messages, leading to a server-side request forgery vulnerability. A successful exploit could allow the attacker to gain access to certain resources that they are not supposed to access.

Recommendations For HUAWEI P40 version 10.1.0.118(C00E116R3P3), consider restricting access to sensitive resources until a patch is available. As a temporary workaround, ensure that all parameters are thoroughly validated to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-37104

Affected Products

Huawei P40

References · 4

• https://huawei.com/en/psirt/security-advisories/huawei-sa-20210922-01-ssrf-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37104 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37104 · Vendor Advisory
• https://t.me/cibsecurity/29564 · Telegram Post