PT-2021-6135 · Huawei · Cloudengine 12800+4

Published 2021-11-03 · Updated 2022-07-12 · CVE-2021-39976

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CloudEngine 12800 versions (affected versions not specified) CloudEngine 5800 version V200R020C00SPC600 CloudEngine 6800 versions (affected versions not specified) CloudEngine 7800 versions (affected versions not specified)

Description The issue is related to a lack of privilege restrictions, which can be exploited by an authenticated local attacker to perform specific operations and potentially obtain higher privileges. This can lead to privilege escalation.

Recommendations For CloudEngine 12800, restrict access to sensitive operations until a fix is available. For CloudEngine 5800 version V200R020C00SPC600, consider disabling local access or limiting privileges for authenticated users until a patch is released. For CloudEngine 6800 and CloudEngine 7800, since specific versions are not mentioned, it is recommended to review the current configuration and restrict access to sensitive operations as a precautionary measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2022-00994

CVE-2021-39976

Affected Products

Cloudengine 12800

Cloudengine 5800

Cloudengine 6800

Cloudengine 7800

Huawei Vrp

References · 6

• https://bdu.fstec.ru/vul/2022-00994 · Security Note
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20211103-01-privilege-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39976 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39976 · Vendor Advisory
• https://securitylab.ru/vulnerability/526223.php · Note
• https://t.me/cibsecurity/32849 · Telegram Post