Details of VAR-202111-0885

ID

VAR-202111-0885

CVE

CVE-2021-22356

TITLE

plural Huawei Vulnerabilities in the use of cryptographic algorithms in products

Trust: 0.8

sources: JVNDB: JVNDB-2021-015659

DESCRIPTION

There is a weak secure algorithm vulnerability in Huawei products. A weak secure algorithm is used in a module. Attackers can exploit this vulnerability by capturing and analyzing the messages between devices to obtain information. This can lead to information leak.Affected product versions include: IPS Module V500R005C00SPC100, V500R005C00SPC200; NGFW Module V500R005C00SPC100, V500R005C00SPC200; Secospace USG6300 V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200; Secospace USG6500 V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200; Secospace USG6600 V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200; USG9500 V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200. plural Huawei The product contains vulnerabilities in the use of cryptographic algorithms.Information may be obtained

Trust: 1.62

sources: NVD: CVE-2021-22356 // JVNDB: JVNDB-2021-015659

AFFECTED PRODUCTS

vendor:	huawei	model:	secospace usg6300	scope:	eq	version:	v500r001c60spc500	Trust: 1.0
vendor:	huawei	model:	secospace usg6300	scope:	eq	version:	v500r005c00spc200	Trust: 1.0
vendor:	huawei	model:	secospace usg6600	scope:	eq	version:	v500r001c60spc500	Trust: 1.0
vendor:	huawei	model:	secospace usg6600	scope:	eq	version:	v500r005c00spc200	Trust: 1.0
vendor:	huawei	model:	secospace usg6300	scope:	eq	version:	v500r001c30spc600	Trust: 1.0
vendor:	huawei	model:	secospace usg6600	scope:	eq	version:	v500r001c30spc600	Trust: 1.0
vendor:	huawei	model:	secospace usg6500	scope:	eq	version:	v500r001c60spc500	Trust: 1.0
vendor:	huawei	model:	secospace usg6500	scope:	eq	version:	v500r005c00spc200	Trust: 1.0
vendor:	huawei	model:	usg9500	scope:	eq	version:	v500r005c00spc100	Trust: 1.0
vendor:	huawei	model:	ngfw module	scope:	eq	version:	v500r005c00spc100	Trust: 1.0
vendor:	huawei	model:	ips module	scope:	eq	version:	v500r005c00spc100	Trust: 1.0
vendor:	huawei	model:	usg9500	scope:	eq	version:	v500r001c30spc200	Trust: 1.0
vendor:	huawei	model:	secospace usg6500	scope:	eq	version:	v500r001c30spc600	Trust: 1.0
vendor:	huawei	model:	secospace usg6600	scope:	eq	version:	v500r005c00spc100	Trust: 1.0
vendor:	huawei	model:	secospace usg6300	scope:	eq	version:	v500r005c00spc100	Trust: 1.0
vendor:	huawei	model:	secospace usg6300	scope:	eq	version:	v500r001c30spc200	Trust: 1.0
vendor:	huawei	model:	secospace usg6600	scope:	eq	version:	v500r001c30spc200	Trust: 1.0
vendor:	huawei	model:	usg9500	scope:	eq	version:	v500r001c60spc500	Trust: 1.0
vendor:	huawei	model:	usg9500	scope:	eq	version:	v500r005c00spc200	Trust: 1.0
vendor:	huawei	model:	secospace usg6500	scope:	eq	version:	v500r005c00spc100	Trust: 1.0
vendor:	huawei	model:	ngfw module	scope:	eq	version:	v500r005c00spc200	Trust: 1.0
vendor:	huawei	model:	usg9500	scope:	eq	version:	v500r001c30spc600	Trust: 1.0
vendor:	huawei	model:	ips module	scope:	eq	version:	v500r005c00spc200	Trust: 1.0
vendor:	huawei	model:	secospace usg6500	scope:	eq	version:	v500r001c30spc200	Trust: 1.0
vendor:	huawei	model:	secospace usg6500	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	ngfw module	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	secospace usg6300	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	secospace usg6600	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	ips module	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	usg9500	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-015659 // NVD: CVE-2021-22356

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-22356
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2021-22356
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202105-2094
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2021-22356
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

nvd@nist.gov:	CVE-2021-22356
baseSeverity:	MEDIUM
baseScore:	5.9
vectorString:	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.2
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2021-22356
baseSeverity:	MEDIUM
baseScore:	5.9
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2021-015659 // CNNVD: CNNVD-202105-2094 // NVD: CVE-2021-22356

PROBLEMTYPE DATA

problemtype:	CWE-327	Trust: 1.0
problemtype:	Use of incomplete or dangerous cryptographic algorithms (CWE-327) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-015659 // NVD: CVE-2021-22356

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202105-2094

TYPE

encryption problem

Trust: 0.6

sources: CNNVD: CNNVD-202105-2094

PATCH

title:	huawei-sa-20210512-01-infomationleak	url:	https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210512-01-infomationleak-en	Trust: 0.8
title:	Fixing measures for vulnerabilities in encryption issues of many Huawei products	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=170393	Trust: 0.6

sources: JVNDB: JVNDB-2021-015659 // CNNVD: CNNVD-202105-2094

EXTERNAL IDS

db:	NVD	id:	CVE-2021-22356	Trust: 3.2
db:	JVNDB	id:	JVNDB-2021-015659	Trust: 0.8
db:	CNNVD	id:	CNNVD-202105-2094	Trust: 0.6

sources: JVNDB: JVNDB-2021-015659 // CNNVD: CNNVD-202105-2094 // NVD: CVE-2021-22356

REFERENCES

url:	https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210512-01-infomationleak-en	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2021-22356	Trust: 1.4
url:	https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20210512-01-infomationleak-cn	Trust: 0.6

sources: JVNDB: JVNDB-2021-015659 // CNNVD: CNNVD-202105-2094 // NVD: CVE-2021-22356

CREDITS

The vulnerability was discovered by Huawei's internal testing

Trust: 0.6

sources: CNNVD: CNNVD-202105-2094

SOURCES

db:	JVNDB	id:	JVNDB-2021-015659
db:	CNNVD	id:	CNNVD-202105-2094
db:	NVD	id:	CVE-2021-22356

LAST UPDATE DATE

2024-08-14T14:02:56.957000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2021-015659	date:	2022-11-29T02:13:00
db:	CNNVD	id:	CNNVD-202105-2094	date:	2021-12-01T00:00:00
db:	NVD	id:	CVE-2021-22356	date:	2021-11-29T16:48:35.053

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2021-015659	date:	2022-11-29T00:00:00
db:	CNNVD	id:	CNNVD-202105-2094	date:	2021-05-12T00:00:00
db:	NVD	id:	CVE-2021-22356	date:	2021-11-23T16:15:08.633