« Volver al listado

CVE-2021-37028

Estado: ModificadaMedia (6.7)—

There is a command injection vulnerability in the HG8045Q product. When the command-line interface is enabled, which is disabled by default, attackers with administrator privilege could execute part of commands.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Huawei — Hg8045q Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-37028",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.9,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@huawei.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "EchoLife HG8045Q",
          "versions": [
            {
              "status": "affected",
              "version": "V300R016C00,V300R018C10"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-08-13T16:15:07.647",
  "references": [
    {
      "url": "http://jvn.jp/en/jp/JVN41646618/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "psirt@huawei.com"
    },
    {
      "url": "https://support.huawei.com/carrier/navi?coltype=software#col=software&from=product&detailId=PBI1-252279599&path=PBI1-252301455/PBI1-252303293/PBI1-23709862/PBI1-22318696/PBI1-21457383",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "psirt@huawei.com"
    },
    {
      "url": "http://jvn.jp/en/jp/JVN41646618/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.huawei.com/carrier/navi?coltype=software#col=software&from=product&detailId=PBI1-252279599&path=PBI1-252301455/PBI1-252303293/PBI1-23709862/PBI1-22318696/PBI1-21457383",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is a command injection vulnerability in the HG8045Q product. When the command-line interface is enabled, which is disabled by default, attackers with administrator privilege could execute part of commands."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de inyección de comandos en el producto HG8045Q. Cuando es habilitado la interfaz de línea de comandos, que está desactivada por defecto, unos atacantes con privilegios de administrador podrían ejecutar parte de los comandos."
    }
  ],
  "lastModified": "2026-06-17T03:59:50.870",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:huawei:hg8045q_firmware:v300r016c00spc110:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1B8E14E-DB72-4DD8-BC62-1DFD6ABE3BBC"
            },
            {
              "criteria": "cpe:2.3:o:huawei:hg8045q_firmware:v300r018c10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "981D96BC-48F7-435A-B4EA-820A5DD58E59"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:huawei:hg8045q:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "23E356D4-C4A7-4468-AAA4-F69EB4F45562"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@huawei.com"
}