Sign-up

ID

VAR-202109-1642


CVE

CVE-2021-37101


TITLE

AIS-BW50-00  Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2021-011970

DESCRIPTION

There is an improper authorization vulnerability in AIS-BW50-00 9.0.6.2(H100SP10C00) and 9.0.6.2(H100SP15C00). Due to improper authorization mangement, an attakcer can exploit this vulnerability by physical accessing the device and implant malicious code. Successfully exploit could leads to arbitrary code execution in the target device. AIS-BW50-00 Exists in unspecified vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Huawei AIS-BW50-00 is a portable bluetooth speaker of China's Huawei (Huawei) company. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements

Trust: 2.79

sources: NVD: CVE-2021-37101 // JVNDB: JVNDB-2021-011970 // CNVD: CNVD-2021-84884 // CNNVD: CNNVD-202104-975 // VULMON: CVE-2021-37101

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-84884

AFFECTED PRODUCTS

vendor:huaweimodel:ais-bw50-00 9.0.6.2scope: - version: -

Trust: 1.2

vendor:huaweimodel:ais-bw50-00scope:eqversion:9.0.6.2\(h100sp10c00\)

Trust: 1.0

vendor:huaweimodel:ais-bw50-00scope:eqversion:9.0.6.2\(h100sp15c00\)

Trust: 1.0

vendor:huaweimodel:ais-bw50-00scope:eqversion:ais-bw50-00 firmware 9.0.6.2(h100sp15c00)

Trust: 0.8

vendor:huaweimodel:ais-bw50-00scope:eqversion:ais-bw50-00 firmware 9.0.6.2(h100sp10c00)

Trust: 0.8

vendor:huaweimodel:ais-bw50-00scope:eqversion: -

Trust: 0.8

sources: CNVD: CNVD-2021-84884 // JVNDB: JVNDB-2021-011970 // NVD: CVE-2021-37101

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-37101
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-37101
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2021-84884
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202109-443
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

VULMON: CVE-2021-37101
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-37101
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2021-84884
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-37101
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2021-37101
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-84884 // VULMON: CVE-2021-37101 // JVNDB: JVNDB-2021-011970 // CNNVD: CNNVD-202109-443 // CNNVD: CNNVD-202104-975 // NVD: CVE-2021-37101

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:others (CWE-Other) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-011970 // NVD: CVE-2021-37101

TYPE

other

Trust: 1.2

sources: CNNVD: CNNVD-202109-443 // CNNVD: CNNVD-202104-975

PATCH

title:huawei-sa-20210908-01-badauthorizationurl:https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210908-01-badauthorization-en

Trust: 0.8

title:Patch for Huawei AIS-BW50-00 incorrect authorization vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/297511

Trust: 0.6

title:Huawei AIS-BW50-00 Remediation measures for authorization problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=161907

Trust: 0.6

sources: CNVD: CNVD-2021-84884 // JVNDB: JVNDB-2021-011970 // CNNVD: CNNVD-202109-443

EXTERNAL IDS

db:NVDid:CVE-2021-37101

Trust: 3.9

db:JVNDBid:JVNDB-2021-011970

Trust: 0.8

db:CNVDid:CNVD-2021-84884

Trust: 0.6

db:CS-HELPid:SB2021090904

Trust: 0.6

db:CNNVDid:CNNVD-202109-443

Trust: 0.6

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:VULMONid:CVE-2021-37101

Trust: 0.1

sources: CNVD: CNVD-2021-84884 // VULMON: CVE-2021-37101 // JVNDB: JVNDB-2021-011970 // CNNVD: CNNVD-202109-443 // CNNVD: CNNVD-202104-975 // NVD: CVE-2021-37101

REFERENCES

url:https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210908-01-badauthorization-en

Trust: 2.3

url:https://nvd.nist.gov/vuln/detail/cve-2021-37101

Trust: 0.8

url:https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20210908-01-badauthorization-cn

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021090904

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/863.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2021-84884 // VULMON: CVE-2021-37101 // JVNDB: JVNDB-2021-011970 // CNNVD: CNNVD-202109-443 // CNNVD: CNNVD-202104-975 // NVD: CVE-2021-37101

CREDITS

The vulnerability was discovered by Huawei's internal testing

Trust: 0.6

sources: CNNVD: CNNVD-202109-443

SOURCES

db:CNVDid:CNVD-2021-84884
db:VULMONid:CVE-2021-37101
db:JVNDBid:JVNDB-2021-011970
db:CNNVDid:CNNVD-202109-443
db:CNNVDid:CNNVD-202104-975
db:NVDid:CVE-2021-37101

LAST UPDATE DATE

2024-08-14T12:30:58.004000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-84884date:2021-11-13T00:00:00
db:VULMONid:CVE-2021-37101date:2021-09-24T00:00:00
db:JVNDBid:JVNDB-2021-011970date:2022-08-19T02:21:00
db:CNNVDid:CNNVD-202109-443date:2022-05-06T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:NVDid:CVE-2021-37101date:2022-05-03T16:04:40.443

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-84884date:2021-11-08T00:00:00
db:VULMONid:CVE-2021-37101date:2021-09-09T00:00:00
db:JVNDBid:JVNDB-2021-011970date:2022-08-19T00:00:00
db:CNNVDid:CNNVD-202109-443date:2021-09-08T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:NVDid:CVE-2021-37101date:2021-09-09T14:15:08.780