Vulnerabilities > CVE-2021-37122 - Use After Free vulnerability in Huawei products

CVSS 6.5 - MEDIUM

Attack vector

ADJACENT_NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

low complexity

huawei

CWE-416

NVD

Published: 2021-10-27

Updated: 2021-10-28

Summary

There is a use-after-free (UAF) vulnerability in Huawei products. An attacker may craft specific packets to exploit this vulnerability. Successful exploitation may cause the service abnormal. Affected product versions include:CloudEngine 12800 V200R005C10SPC800,V200R019C00SPC800;CloudEngine 5800 V200R005C10SPC800,V200R019C00SPC800;CloudEngine 6800 V200R005C10SPC800,V200R005C20SPC800,V200R019C00SPC800;CloudEngine 7800 V200R005C10SPC800,V200R019C00SPC800.

Vulnerable Configurations

Part	Description	Count
OS	Huawei Huawei Cloudengine 12800 Firmware V200R005C10Spc800 Huawei Cloudengine 12800 Firmware V200R019C00Spc800 Huawei Cloudengine 5800 Firmware V200R005C10Spc800 Huawei Cloudengine 5800 Firmware V200R019C00Spc800 Huawei Cloudengine 6800 Firmware V200R005C10Spc800 Huawei Cloudengine 6800 Firmware V200R005C20Spc800 Huawei Cloudengine 6800 Firmware V200R019C00Spc800 Huawei Cloudengine 7800 Firmware V200R005C10Spc800 Huawei Cloudengine 7800 Firmware V200R019C00Spc800	9
Hardware	Huawei Huawei Cloudengine 12800 - Huawei Cloudengine 5800 - Huawei Cloudengine 6800 - Huawei Cloudengine 7800 -	4

Common Weakness Enumeration (CWE)

CWE-416 - Use After Free

References

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211008-01-cloudengine-en