PT-2021-3957 · Huawei · Ecns280+1

Published 2021-04-21 · Updated 2021-07-02 · CVE-2021-22338

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions eCNS280 versions V100R005C00 through V100R005C10

Description The issue is related to an XXE injection vulnerability. A module does not perform strict operations on the input XML message, allowing an attacker to send a specific message to exploit this vulnerability. This can lead to a denial of service of the module. The vulnerability is associated with incorrect restriction of XML links to external objects, which can be exploited by a remote attacker.

Recommendations For eCNS280 versions V100R005C00 and V100R005C10, consider disabling the module that processes XML messages until a patch is available to prevent exploitation. As a temporary workaround, restrict access to the module that handles XML input to minimize the risk of denial of service. Avoid using the vulnerable module until the issue is resolved with a proper fix. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2021-04476

CVE-2021-22338

Affected Products

Huawei Vrp

Ecns280

References · 5

• https://bdu.fstec.ru/vul/2021-04476 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22338 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22338 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20210421-01-cgp-en · Vendor Advisory
• https://t.me/cibsecurity/25800 · Telegram Post