CVE-2021-22341 Denial of service in IPS Module;NGFW Module;NIP6300;NIP6600;Secospace USG6300;Secospace USG6500;Secospace USG6600
High-privilege attackers can trigger a memory leak in Huawei network security modules, potentially causing service disruption.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22341?
CVE-2021-22341 is a medium-severity denial of service vulnerability in Huawei Ips Module Firmware, published on 29 Jun 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
There is a memory leak vulnerability in Huawei products. A resource management weakness exists in a module. Attackers with high privilege can exploit this vulnerability by performing some operations. This can lead to memory leak. Affected product versions include:IPS Module V500R005C00SPC100,V500R005C00SPC200;NGFW Module V500R005C00SPC100,V500R005C00SPC200;NIP6300 V500R005C00SPC100,V500R005C10SPC200;NIP6600 V500R005C00SPC100,V500R005C00SPC200;Secospace USG6300 V500R005C00SPC100,V500R005C00SPC200;Secospace USG6500 V500R005C00SPC100,V500R005C10SPC200;Secospace USG6600 V500R005C00SPC100,V500R005C00SPC200.
Weakness: CWE-401
Which versions are affected by CVE-2021-22341?
It affects 7 products.
Products include Huawei Ips Module Firmware, Huawei Ngfw Module Firmware, Huawei Nip6300 Firmware, Huawei Nip6600 Firmware, Huawei Secospace Usg6300 Firmware, Huawei Secospace Usg6500 Firmware and 1 more.
How do I fix CVE-2021-22341?
No fix has been published for CVE-2021-22341 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-22341 being exploited?
There is no known exploitation of CVE-2021-22341 in the wild and no public exploit code.
Other vulnerabilities in Huawei Ips Module Firmware
- CVE-2020-9099 Auth bypass in IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospace USG6300; Secospace USG6500; Secospace USG6600; USG9500
- CVE-2016-4576 Memory corruption in n/a
- CVE-2021-37129 Memory corruption in IIPS Module;NGFW Module;NIP6600;S12700;S1700;S2700;S5700;S6700;S7700;S9700;USG9500
- CVE-2021-22320 Denial of service in IPS Module;NGFW Module;NIP6600;NIP6800;Secospace USG6300;Secospace USG6500;Secospace USG6600
- CVE-2017-15348 Denial of service in IPS Module,NGFW Module,NIP6300,NIP6600,Secospace USG6300,Secospace USG6500,Secospace USG6600,USG9500,
Sources
Also known as GHSA-vw67-jhpq-87pm.