Details of VAR-202106-0600

ID

VAR-202106-0600

CVE

CVE-2021-22377

TITLE

multiple Huawei Product input verification vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2021-008572

DESCRIPTION

There is a command injection vulnerability in S12700 V200R019C00SPC500, S2700 V200R019C00SPC500, S5700 V200R019C00SPC500, S6700 V200R019C00SPC500 and S7700 V200R019C00SPC500. A module does not verify specific input sufficiently. Attackers can exploit this vulnerability by sending malicious parameters to inject command. This can compromise normal service. multiple Huawei The product contains an input verification vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Huawei S12700, etc. are all enterprise-level switch products of China's Huawei (Huawei). Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements

Trust: 2.7

sources: NVD: CVE-2021-22377 // JVNDB: JVNDB-2021-008572 // CNVD: CNVD-2022-20321 // CNNVD: CNNVD-202104-975

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2022-20321

AFFECTED PRODUCTS

vendor:	huawei	model:	s5700	scope:	eq	version:	v200r019c00spc500	Trust: 1.0
vendor:	huawei	model:	s7700	scope:	eq	version:	v200r019c00spc500	Trust: 1.0
vendor:	huawei	model:	s12700	scope:	eq	version:	v200r019c00spc500	Trust: 1.0
vendor:	huawei	model:	s6700	scope:	eq	version:	v200r019c00spc500	Trust: 1.0
vendor:	huawei	model:	s2700	scope:	eq	version:	v200r019c00spc500	Trust: 1.0
vendor:	huawei	model:	s6700	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	s7700	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	s12700	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	s2700	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	s5700	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	s12700 v200r019c00spc500	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	s2700 v200r019c00spc500	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	s5700 v200r019c00spc500	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	s6700 v200r019c00spc500	scope:	-	version:	-	Trust: 0.6
vendor:	huawei	model:	s7700 v200r019c00spc500	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2022-20321 // JVNDB: JVNDB-2021-008572 // NVD: CVE-2021-22377

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-22377
value:	HIGH
Trust: 1.0
NVD:	CVE-2021-22377
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2022-20321
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202104-975
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202106-343
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2021-22377
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2022-20321
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:L/AC:L/AU:S/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.1
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2021-22377
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2021-22377
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2022-20321 // JVNDB: JVNDB-2021-008572 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-343 // NVD: CVE-2021-22377

PROBLEMTYPE DATA

problemtype:	CWE-20	Trust: 1.0
problemtype:	Incorrect input confirmation (CWE-20) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-008572 // NVD: CVE-2021-22377

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202106-343

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:	huawei-sa-20210602-01-cmdinj	url:	https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210602-01-cmdinj-en	Trust: 0.8
title:	Patch for Command Injection Vulnerability in Multiple Huawei Products	url:	https://www.cnvd.org.cn/patchInfo/show/326156	Trust: 0.6
title:	Multiple Huawei Product input verification error vulnerability fixes	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=155521	Trust: 0.6

sources: CNVD: CNVD-2022-20321 // JVNDB: JVNDB-2021-008572 // CNNVD: CNNVD-202106-343

EXTERNAL IDS

db:	NVD	id:	CVE-2021-22377	Trust: 3.8
db:	JVNDB	id:	JVNDB-2021-008572	Trust: 0.8
db:	CNVD	id:	CNVD-2022-20321	Trust: 0.6
db:	CS-HELP	id:	SB2021041363	Trust: 0.6
db:	CNNVD	id:	CNNVD-202104-975	Trust: 0.6
db:	CS-HELP	id:	SB2021060402	Trust: 0.6
db:	CNNVD	id:	CNNVD-202106-343	Trust: 0.6

sources: CNVD: CNVD-2022-20321 // JVNDB: JVNDB-2021-008572 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-343 // NVD: CVE-2021-22377

REFERENCES

url:	https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210602-01-cmdinj-en	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2021-22377	Trust: 1.4
url:	https://www.cybersecurity-help.cz/vdb/sb2021041363	Trust: 0.6
url:	https://www.cybersecurity-help.cz/vdb/sb2021060402	Trust: 0.6
url:	https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20210602-01-cmdinj-cn	Trust: 0.6

sources: CNVD: CNVD-2022-20321 // JVNDB: JVNDB-2021-008572 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-343 // NVD: CVE-2021-22377

SOURCES

db:	CNVD	id:	CNVD-2022-20321
db:	JVNDB	id:	JVNDB-2021-008572
db:	CNNVD	id:	CNNVD-202104-975
db:	CNNVD	id:	CNNVD-202106-343
db:	NVD	id:	CVE-2021-22377

LAST UPDATE DATE

2024-08-14T12:49:26.566000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2022-20321	date:	2022-03-17T00:00:00
db:	JVNDB	id:	JVNDB-2021-008572	date:	2022-03-18T09:13:00
db:	CNNVD	id:	CNNVD-202104-975	date:	2021-04-14T00:00:00
db:	CNNVD	id:	CNNVD-202106-343	date:	2021-07-01T00:00:00
db:	NVD	id:	CVE-2021-22377	date:	2021-06-29T17:07:26.450

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2022-20321	date:	2022-03-17T00:00:00
db:	JVNDB	id:	JVNDB-2021-008572	date:	2022-03-18T00:00:00
db:	CNNVD	id:	CNNVD-202104-975	date:	2021-04-13T00:00:00
db:	CNNVD	id:	CNNVD-202106-343	date:	2021-06-02T00:00:00
db:	NVD	id:	CVE-2021-22377	date:	2021-06-22T19:15:07.953