CVE-2021-22309 Weak cryptography in USG9500,USG9520,USG9560,USG9580
Attackers can brute force sensitive messages due to insecure random input in Huawei USG firewalls, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22309?
CVE-2021-22309 is a high-severity vulnerability in Huawei Usg9500 Firmware, published on 22 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There is insecure algorithm vulnerability in Huawei products. A module uses less random input in a secure mechanism. Attackers can exploit this vulnerability by brute forcing to obtain sensitive message. This can lead to information leak. Affected product versions include:USG9500 versions V500R001C30SPC200, V500R001C60SPC500,V500R005C00SPC200;USG9520 versions V500R005C00;USG9560 versions V500R005C00;USG9580 versions V500R005C00.
Weakness: CWE-330
Which versions are affected by CVE-2021-22309?
It affects 4 products.
Products include Huawei Usg9500 Firmware, Huawei Usg9520 Firmware, Huawei Usg9560 Firmware, Huawei Usg9580 Firmware.
How do I fix CVE-2021-22309?
No fix has been published for CVE-2021-22309 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-22309 being exploited?
There is no known exploitation of CVE-2021-22309 in the wild and no public exploit code.
Other vulnerabilities in Huawei Usg9500 Firmware
Sources
Also known as GHSA-3fcq-hfv4-xfg4.