Vulnerability in Huawei Ips6000e
CVE-2021-22312
There is a memory leak vulnerability in some Huawei products. An authenticated remote attacker may exploit this vulnerability by sending specific message to the affected product. Due to not release the allocated memory properly, successful exploit may cause some service abnormal. Affected product include some versions of IPS Module, NGFW Module, Secospace USG6300, Secospace USG6500, Secospace USG6600 and USG9500.
EPSS: 0.008 (53.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Huawei Ips6000e
- Huawei Ips6000e_firmware — versions v600r006c00
- Huawei Ips_module
- Huawei Ips_module_firmware — versions v500r005c00spc100, v500r005c00spc200
- Huawei Ngfw_module
- Huawei Ngfw_module_firmware — versions v500r005c00spc100, v500r005c00spc200
- Huawei Nip6000e
- Huawei Nip6000e_firmware — versions v600r006c00
- Huawei Nip6300
- Huawei Nip6300_firmware — versions v500r001c30spc200, v500r001c30spc600, v500r001c60spc500
Weakness classification (CWE)
References
- psirt@huawei.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-22312?
- CVE-2021-22312 is a medium-severity vulnerability in Huawei Ips6000e, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 6.5/10. Published 2021-04-08.
- How severe is CVE-2021-22312?
- Medium severity. CVSS v3 base score is 6.5 out of 10.