PT-2022-6030 · Huawei · Cloudengine 12800+4

Published 2022-01-20 · Updated 2022-02-04 · CVE-2021-40042

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions CloudEngine 12800 versions V200R019C10SPC800 through V200R019C10SPC900 CloudEngine 5800 versions V200R019C10SPC800 through V200R020C00SPC600 CloudEngine 6800 versions V200R019C10SPC800 through V300R020C00SPC200 CloudEngine 7800 version V200R019C10SPC800

Description The issue is related to an invalid pointer vulnerability in some Huawei products. Successful exploitation may cause process and service abnormalities. The vulnerability can be exploited by a remote attacker using specially crafted messages, potentially leading to a denial of service.

Recommendations For CloudEngine 12800 versions V200R019C10SPC800 through V200R019C10SPC900, update to a fixed version to resolve the issue. For CloudEngine 5800 versions V200R019C10SPC800 through V200R020C00SPC600, update to a fixed version to resolve the issue. For CloudEngine 6800 versions V200R019C10SPC800 through V300R020C00SPC200, update to a fixed version to resolve the issue. For CloudEngine 7800 version V200R019C10SPC800, update to a fixed version to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable products until a patch is available.

Fix

Weakness Enumeration

CWE-763

Related Identifiers

BDU:2022-07485

CVE-2021-40042

Affected Products

Cloudengine 12800

Cloudengine 5800

Cloudengine 6800

Cloudengine 7800

Huawei Vrp

References · 7

• https://huawei.com/en/psirt/security-advisories/huawei-sa-20220112-01-invalid-en · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-40042 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40042 · Security Note
• https://bdu.fstec.ru/vul/2022-07485 · Security Note
• https://t.me/cvenotify/26283 · Telegram Post
• https://t.me/cibsecurity/36590 · Telegram Post
• https://t.me/cvenotify/26071 · Telegram Post