« Volver al listado

CVE-2021-37101

Estado: ModificadaMedia (6.8)—

Se presenta una vulnerabilidad de autorización inapropiada en AIS-BW50-00 versiones 9.0.6.2(H100SP10C00) y 9.0.6.2(H100SP15C00). Debido a una administración inapropiada de la autorización, un atacante puede explotar esta vulnerabilidad accediendo físicamente al dispositivo e implantando código malicioso. Una explotación con éxito podría conllevar a una ejecución de código arbitrario en el dispositivo de destino

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Huawei — Ais-bw50-00 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-37101",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@huawei.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "AIS-BW50-00",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.6.2(H100SP10C00),9.0.6.2(H100SP15C00)"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-09-09T14:15:08.780",
  "references": [
    {
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210908-01-badauthorization-en",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@huawei.com"
    },
    {
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210908-01-badauthorization-en",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is an improper authorization vulnerability in AIS-BW50-00 9.0.6.2(H100SP10C00) and 9.0.6.2(H100SP15C00). Due to improper authorization mangement, an attakcer can exploit this vulnerability by physical accessing the device and implant malicious code. Successfully exploit could leads to arbitrary code execution in the target device."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de autorización inapropiada en AIS-BW50-00 versiones 9.0.6.2(H100SP10C00) y 9.0.6.2(H100SP15C00). Debido a una administración inapropiada de la autorización, un atacante puede explotar esta vulnerabilidad accediendo físicamente al dispositivo e implantando código malicioso. Una explotación con éxito podría conllevar a una ejecución de código arbitrario en el dispositivo de destino"
    }
  ],
  "lastModified": "2026-06-17T03:59:58.403",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:ais-bw50-00_firmware:9.0.6.2\\(h100sp10c00\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "516D3861-68A7-44DE-8F15-06611E9BAF50"
            },
            {
              "criteria": "cpe:2.3:o:huawei:ais-bw50-00_firmware:9.0.6.2\\(h100sp15c00\\):*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EECFD508-15BD-4B74-BCB8-05BCDEFD4AED"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:ais-bw50-00:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2213030F-6DBC-45A1-85D9-6676653109F0"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@huawei.com"
}