PT-2021-21524 · Huawei · Cloudengine 7800+4

Published 2021-10-08 · Updated 2021-10-28 · CVE-2021-37122

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions CloudEngine 12800 versions V200R005C10SPC800 through V200R019C00SPC800 CloudEngine 5800 versions V200R005C10SPC800 through V200R019C00SPC800 CloudEngine 6800 versions V200R005C10SPC800 through V200R019C00SPC800 CloudEngine 7800 versions V200R005C10SPC800 through V200R019C00SPC800

Description There is a use-after-free (UAF) vulnerability in Huawei products. An attacker may craft specific packets to exploit this vulnerability. Successful exploitation may cause the service to become abnormal.

Recommendations For CloudEngine 12800 versions V200R005C10SPC800 through V200R019C00SPC800, update to a version that includes the fix for this issue. For CloudEngine 5800 versions V200R005C10SPC800 through V200R019C00SPC800, update to a version that includes the fix for this issue. For CloudEngine 6800 versions V200R005C10SPC800 through V200R019C00SPC800, update to a version that includes the fix for this issue. For CloudEngine 7800 versions V200R005C10SPC800 through V200R019C00SPC800, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the vulnerable service to minimize the risk of exploitation.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2021-37122

Affected Products

Cloudengine 12800

Cloudengine 5800

Cloudengine 6800

Cloudengine 7800

Huawei Vrp

References · 5

• https://osv.dev/vulnerability/CVE-2021-37122 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37122 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20211008-01-cloudengine-en · Vendor Advisory
• https://t.me/cvenotify/22429 · Telegram Post
• https://t.me/cvenotify/22455 · Telegram Post