PT-2021-7547 · Huawei · Imanager Neteco 6000+3

Published 2021-10-20 · Updated 2021-10-29 · CVE-2021-37131

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ManageOne (affected versions not specified) iManager NetEco (affected versions not specified) iManager NetEco 6000 (affected versions not specified)

Description The issue is related to a CSV injection vulnerability. An attacker with high privilege may exploit this vulnerability through some operations to inject CSV files. The vulnerability is due to insufficient input validation of some parameters, allowing the attacker to inject CSV files to the target device. This can potentially allow a remote attacker to execute arbitrary code.

Recommendations For ManageOne, consider disabling the functionality that allows CSV file injection until a patch is available. For iManager NetEco, restrict access to the vulnerable parameters to minimize the risk of exploitation. For iManager NetEco 6000, avoid using the vulnerable operations that allow CSV file injection until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

BDU:2022-07483

CVE-2021-37131

Affected Products

Huawei Vrp

Manageone

Imanager Neteco

Imanager Neteco 6000

References · 5

• https://osv.dev/vulnerability/CVE-2021-37131 · Vendor Advisory
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20211020-01-csv-en · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07483 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-37131 · Security Note
• https://t.me/cvenotify/22433 · Telegram Post