« Volver al listado

CVE-2021-22361

Estado: ModificadaAlta (7.8)—

There is an improper authorization vulnerability in eCNS280 V100R005C00, V100R005C10 and eSE620X vESS V100R001C10SPC200, V100R001C20SPC200. A file access is not authorized correctly. Attacker with low access may launch privilege escalation in a specific scenario. This may compromise the normal service.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Huawei — Ecns280 FirmwareHuawei — Ese620x Vess Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-22361",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@huawei.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "eCNS280;eSE620X vESS",
          "versions": [
            {
              "status": "affected",
              "version": "V100R005C00,V100R005C10"
            },
            {
              "status": "affected",
              "version": "V100R001C10SPC200,V100R001C20SPC200"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-06-22T18:15:07.960",
  "references": [
    {
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210519-02-cgp-en",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@huawei.com"
    },
    {
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210519-02-cgp-en",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is an improper authorization vulnerability in eCNS280 V100R005C00, V100R005C10 and eSE620X vESS V100R001C10SPC200, V100R001C20SPC200. A file access is not authorized correctly. Attacker with low access may launch privilege escalation in a specific scenario. This may compromise the normal service."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de autorización inapropiada en eCNS280 V100R005C00, V100R005C10 y eSE620X vESS V100R001C10SPC200, V100R001C20SPC200. El acceso a un archivo no está autorizado correctamente. Un atacante con bajo acceso puede lanzar una escalada de privilegios en un escenario específico. Esto puede comprometer el servicio normal"
    }
  ],
  "lastModified": "2026-06-17T03:37:03.837",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:ecns280_firmware:v100r005c00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "576F98F8-B0AB-4D3F-B1EC-65FD12C91A79"
            },
            {
              "criteria": "cpe:2.3:o:huawei:ecns280_firmware:v100r005c10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "375D7506-5F13-4CAA-800F-6C73ADEBF2E7"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:ecns280:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "35F2A8E0-6BF8-4F16-9E44-B05B8FE72FDC"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:ese620x_vess_firmware:v100r001c10spc200:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D09A362-885C-4CAD-931B-ECFBB857F849"
            },
            {
              "criteria": "cpe:2.3:o:huawei:ese620x_vess_firmware:v100r001c20spc200:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB48C0D8-E413-411E-9565-9AABA0A70CD1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:ese620x_vess:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "9AC039E0-A953-4C79-B751-5B9738371DF0"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@huawei.com"
}