CVE-2021-22312
Medium
Description
There is a memory leak vulnerability in some Huawei products. An authenticated remote attacker may exploit this vulnerability by sending specific message to the affected product. Due to not release the allocated memory properly, successful exploit may cause some service abnormal. Affected product include some versions of IPS Module, NGFW Module, Secospace USG6300, Secospace USG6500, Secospace USG6600 and USG9500.
SeverityMedium
CVSS6.5
Exploit probability—
ProductHuawei Ngfw Module Firmware
PublishedApr 8, 2021
First seenApr 8, 2021
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| huawei ngfw_module_firmware | v500r005c00spc100, v500r005c00spc200 | — |
| huawei ips_module_firmware | v500r005c00spc100, v500r005c00spc200 | — |
| huawei secospace_usg6300_firmware | v500r001c30spc200, v500r001c30spc600, v500r001c60spc500, v500r005c00spc100, v500r005c00spc200 | — |
| huawei secospace_usg6500_firmware | v500r001c30spc200, v500r001c30spc600, v500r001c60spc500, v500r005c00spc100, v500r005c00spc200 | — |
| huawei secospace_usg6600_firmware | v500r001c30spc200, v500r001c30spc600, v500r001c60spc500, v500r005c00spc100, v500r005c00spc200 | — |
| huawei usg9500_firmware | v500r001c30spc200, v500r001c30spc600, v500r001c60spc500, v500r005c00spc100, v500r005c00spc200 | — |
| huawei nip6300_firmware | v500r001c30spc200, v500r001c30spc600, v500r001c60spc500, v500r005c00spc100, v500r005c00spc200 | — |
| huawei nip6600_firmware | v500r001c30spc200, v500r001c30spc600, v500r001c60spc500, v500r005c00spc100, v500r005c00spc200 | — |
| huawei nip6800_firmware | v500r001c30spc200, v500r001c30spc600, v500r001c60spc500, v500r005c00spc100, v500r005c00spc200 | — |
| huawei usg6000e_firmware | v600r006c00 | — |
| huawei nip6000e_firmware | v600r006c00 | — |
| huawei ips6000e_firmware | v600r006c00 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.