PT-2021-4899 · Huawei · Fusioncompute

Published 2021-09-22 · Updated 2022-05-03 · CVE-2021-37106

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FusionCompute versions 6.3.0 through 6.3.1 FusionCompute version 6.5.0 FusionCompute version 8.0.0

Description The issue is related to a command injection vulnerability in the CMA service module of FusionCompute. This occurs when the software processes the default certificate file and constructs part of a command using external special input from users without sufficient validation of the user input. Successful exploitation could allow an attacker to inject certain commands into the system, potentially enabling remote execution of arbitrary commands.

Recommendations For FusionCompute versions 6.3.0 through 6.3.1, consider disabling the default certificate file processing until a patch is available. For FusionCompute version 6.5.0, restrict access to the CMA service module to minimize the risk of exploitation. For FusionCompute version 8.0.0, avoid using external special input from users in the default certificate file processing until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2021-05634

CVE-2021-37106

Affected Products

Fusioncompute

References · 6

• https://osv.dev/vulnerability/CVE-2021-37106 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37106 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20210922-01-commandinjection-en · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05634 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021092302 · Note
• https://t.me/cibsecurity/29569 · Telegram Post