PT-2021-3529 · Huawei · Huawei Anyoffice

Published 2021-06-19 · Updated 2021-07-02 · CVE-2021-22439

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Huawei AnyOffice version V200R006C10

Description The issue is related to a deserialization vulnerability that allows an attacker to construct a specific request to exploit it. Successfully exploiting this vulnerability enables the attacker to execute remote malicious code injection and control the device. It is associated with the restoration of untrusted data in memory, which can allow a remote attacker to execute arbitrary code or gain full control of the application using a specially crafted request.

Recommendations For Huawei AnyOffice version V200R006C10, consider disabling the deserialization function temporarily until a patch is available to prevent remote malicious code injection. Restrict access to the application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2021-03579

CVE-2021-22439

Affected Products

Huawei Anyoffice

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-22439 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20210619-01-injection-en · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03579 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22439 · Vendor Advisory
• https://vuldb.com/?id.177763 · Note