PT-2021-3501 · Huawei · S2700+7

Published 2021-04-07 · Updated 2021-07-07 · CVE-2021-22329

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Huawei S12700 versions V200R007C01 through V200R011C10 Huawei S1700 versions V200R010C00SPC300 through V200R011C10 Huawei S2700 versions V200R008C00 through V200R011C10 Huawei S5700 versions V200R008C00 through V200R011C10SPC100 Huawei S6700 versions V200R008C00 through V200R011C10SPC100 Huawei S7700 versions V200R008C00 through V200R011C10 Huawei S9700 versions V200R007C01 through V200R011C10

Description The issue is related to improper license management in Huawei products, allowing an attacker with high privilege to perform specific operations and affect the integrity of the device by applying a license file.

Recommendations For Huawei S12700 versions V200R007C01 through V200R011C10, update to a version that includes the fix for the license management vulnerability. For Huawei S1700 versions V200R010C00SPC300 through V200R011C10, update to a version that includes the fix for the license management vulnerability. For Huawei S2700 versions V200R008C00 through V200R011C10, update to a version that includes the fix for the license management vulnerability. For Huawei S5700 versions V200R008C00 through V200R011C10SPC100, update to a version that includes the fix for the license management vulnerability. For Huawei S6700 versions V200R008C00 through V200R011C10SPC100, update to a version that includes the fix for the license management vulnerability. For Huawei S7700 versions V200R008C00 through V200R011C10, update to a version that includes the fix for the license management vulnerability. For Huawei S9700 versions V200R007C01 through V200R011C10, update to a version that includes the fix for the license management vulnerability. As a temporary workaround, consider restricting access to the license management functionality until a patch is available.

Fix

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2021-03531

CVE-2021-22329

Affected Products

Huawei Vrp

S12700

S1700

S2700

S5700

S6700

S7700

S9700

References · 7

• https://osv.dev/vulnerability/CVE-2021-22329 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03531 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20210407-01-resourcemanagement-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22329 · Security Note
• https://t.me/cvenotify/17196 · Telegram Post
• https://t.me/cvenotify/16852 · Telegram Post
• https://t.me/cibsecurity/25805 · Telegram Post