CVE-2021-22338 XML external entity in eCNS280
An XXE vulnerability in Huawei eCNS280 allows attackers to cause a denial of service by sending malicious XML messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22338?
CVE-2021-22338 is a medium-severity vulnerability in eCNS280, published on 29 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There is an XXE injection vulnerability in eCNS280 V100R005C00 and V100R005C10. A module does not perform the strict operation to the input XML message. Attacker can send specific message to exploit this vulnerability, leading to the module denial of service.
Weakness: CWE-611
Which versions are affected by CVE-2021-22338?
It affects 1 product.
Products include Huawei Ecns280 Firmware.
How do I fix CVE-2021-22338?
No fix has been published for CVE-2021-22338 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-22338 being exploited?
There is no known exploitation of CVE-2021-22338 in the wild and no public exploit code.
Other vulnerabilities in eCNS280
Sources
Also known as GHSA-9ph9-qc4h-6c7p.