CVE-2021-22309

There is insecure algorithm vulnerability in Huawei products. A module uses less random input in a secure mechanism. Attackers can exploit this vulnerability by brute forcing to obtain sensitive message. This can lead to information leak. Affected product versions include:USG9500 versions V500R001C30SPC200, V500R001C60SPC500,V500R005C00SPC200;USG9520 versions V500R005C00;USG9560 versions V500R005C00;USG9580 versions V500R005C00.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210202-01-fw-en	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:huawei:usg9500_firmware:v500r001c30spc200:::::::*
	cpe:2.3:o:huawei:usg9500_firmware:v500r001c60spc500:::::::*
	cpe:2.3:o:huawei:usg9500_firmware:v500r005c00spc200:::::::*

cpe:2.3:h:huawei:usg9500:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:huawei:usg9520_firmware:v500r005c00:*:*:*:*:*:*:*

cpe:2.3:h:huawei:usg9520:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:huawei:usg9560_firmware:v500r005c00:*:*:*:*:*:*:*

cpe:2.3:h:huawei:usg9560:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:huawei:usg9580_firmware:v500r005c00:*:*:*:*:*:*:*

cpe:2.3:h:huawei:usg9580:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-03-22 18:15

Updated : 2024-02-28 18:08

NVD link : CVE-2021-22309

Mitre link : CVE-2021-22309

CVE.ORG link : CVE-2021-22309

JSON object : View

Products Affected

huawei

usg9560_firmware
usg9560
usg9500_firmware
usg9580
usg9500
usg9520_firmware
usg9520
usg9580_firmware

CWE

CWE-330

Use of Insufficiently Random Values

{"id": "CVE-2021-22309", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-03-22T18:15:14.433", "references": [{"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210202-01-fw-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-330"}]}], "descriptions": [{"lang": "en", "value": "There is insecure algorithm vulnerability in Huawei products. A module uses less random input in a secure mechanism. Attackers can exploit this vulnerability by brute forcing to obtain sensitive message. This can lead to information leak. Affected product versions include:USG9500 versions V500R001C30SPC200, V500R001C60SPC500,V500R005C00SPC200;USG9520 versions V500R005C00;USG9560 versions V500R005C00;USG9580 versions V500R005C00."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de algoritmo no seguro en unos productos Huawei. Un m\u00f3dulo usa una entrada poco aleatoria en un mecanismo seguro. Unos atacantes pueden explotar esta vulnerabilidad mediante fuerza bruta para obtener mensajes confidenciales. Esto puede conllevar a un filtrado de informaci\u00f3n. Las versiones de producto afectadas incluyen: USG9500 versiones V500R001C30SPC200, V500R001C60SPC500, V500R005C00SPC200; USG9520 versiones V500R005C00; USG9560 versiones V500R005C00; USG9580 versiones V500R005C00"}], "lastModified": "2022-07-12T17:42:04.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:usg9500_firmware:v500r001c30spc200:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0BF5257-8CD1-4951-9C53-07B85D468F8B"}, {"criteria": "cpe:2.3:o:huawei:usg9500_firmware:v500r001c60spc500:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A1EFB9D-5349-4EAF-9880-34F0D20011E4"}, {"criteria": "cpe:2.3:o:huawei:usg9500_firmware:v500r005c00spc200:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADA71C5D-4B11-401D-AEC9-907204C21476"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:usg9500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4B6064BB-5E62-4D70-B933-05B5426EEE9C"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:usg9520_firmware:v500r005c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CAE4B21-DB0F-46BA-AEEF-878CFE2CB120"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:usg9520:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "60030EDB-682F-4107-80FC-5F03CE75131D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:usg9560_firmware:v500r005c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "752FD81F-0750-4200-B732-304306D31BF9"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:usg9560:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "96AFE94D-EDC7-4372-A1BF-8089D5551AD9"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:usg9580_firmware:v500r005c00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F890E352-DB01-4BF0-A709-0F63AE3F91AE"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:usg9580:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "14C9D3E2-B016-4238-A170-6C4AD1B3B76C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}