CVE-2021-37127

Опубликовано: 27 окт. 2021

Источник: nvd

CVSS3: 7.2

CVSS2: 9

EPSS Низкий

Описание

There is a signature management vulnerability in some huawei products. An attacker can forge signature and bypass the signature check. During firmware update process, successful exploit this vulnerability can cause the forged system file overwrite the correct system file. Affected product versions include:iManager NetEco V600R010C00CP2001,V600R010C00CP2002,V600R010C00SPC100,V600R010C00SPC110,V600R010C00SPC120,V600R010C00SPC200,V600R010C00SPC210,V600R010C00SPC300;iManager NetEco 6000 V600R009C00SPC100,V600R009C00SPC110,V600R009C00SPC120,V600R009C00SPC190,V600R009C00SPC200,V600R009C00SPC201,V600R009C00SPC202,V600R009C00SPC210.

Ссылки

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211020-01-signature-en
Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211020-01-signature-en
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:o:huawei:imanager_neteco_6000_firmware:v600r010c00cp2001:*:*:*:*:*:*:*

cpe:2.3:o:huawei:imanager_neteco_6000_firmware:v600r010c00cp2002:*:*:*:*:*:*:*

cpe:2.3:o:huawei:imanager_neteco_6000_firmware:v600r010c00spc100:*:*:*:*:*:*:*

cpe:2.3:o:huawei:imanager_neteco_6000_firmware:v600r010c00spc110:*:*:*:*:*:*:*

cpe:2.3:o:huawei:imanager_neteco_6000_firmware:v600r010c00spc120:*:*:*:*:*:*:*

cpe:2.3:o:huawei:imanager_neteco_6000_firmware:v600r010c00spc200:*:*:*:*:*:*:*

cpe:2.3:o:huawei:imanager_neteco_6000_firmware:v600r010c00spc210:*:*:*:*:*:*:*

cpe:2.3:o:huawei:imanager_neteco_6000_firmware:v600r010c00spc300:*:*:*:*:*:*:*

cpe:2.3:h:huawei:imanager_neteco_6000:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

Одно из

cpe:2.3:o:huawei:imanager_neteco_firmware:v600r009c00spc100:*:*:*:*:*:*:*

cpe:2.3:o:huawei:imanager_neteco_firmware:v600r009c00spc110:*:*:*:*:*:*:*

cpe:2.3:o:huawei:imanager_neteco_firmware:v600r009c00spc120:*:*:*:*:*:*:*

cpe:2.3:o:huawei:imanager_neteco_firmware:v600r009c00spc190:*:*:*:*:*:*:*

cpe:2.3:o:huawei:imanager_neteco_firmware:v600r009c00spc200:*:*:*:*:*:*:*

cpe:2.3:o:huawei:imanager_neteco_firmware:v600r009c00spc201:*:*:*:*:*:*:*

cpe:2.3:o:huawei:imanager_neteco_firmware:v600r009c00spc202:*:*:*:*:*:*:*

cpe:2.3:o:huawei:imanager_neteco_firmware:v600r009c00spc210:*:*:*:*:*:*:*

cpe:2.3:h:huawei:imanager_neteco:-:*:*:*:*:*:*:*

EPSS

Процентиль: 28%

0.00101

Низкий

7.2 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-347

Связанные уязвимости

GHSA-929h-mg2v-7c23

github

больше 3 лет назад