CVE-2021-22361 Missing authorization in eCNS280;eSE620X vESS

High 7.8 Published 22 Jun 2021 Updated 3 Aug 2024

Improper file access authorization in Huawei eCNS280 and eSE620X allows low-privilege attackers to escalate privileges and disrupt services.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-22361?

CVE-2021-22361 is a high-severity missing authorization vulnerability in eCNS280;eSE620X vESS, published on 22 Jun 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

There is an improper authorization vulnerability in eCNS280 V100R005C00, V100R005C10 and eSE620X vESS V100R001C10SPC200, V100R001C20SPC200. A file access is not authorized correctly. Attacker with low access may launch privilege escalation in a specific scenario. This may compromise the normal service.

Which versions are affected by CVE-2021-22361?

It affects 2 products.

Products include Huawei Ecns280 Firmware, Huawei Ese620x Vess Firmware.

How do I fix CVE-2021-22361?

No fix has been published for CVE-2021-22361 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-22361 being exploited?

There is no known exploitation of CVE-2021-22361 in the wild and no public exploit code.

Sources

Also known as GHSA-2mqr-75c4-43q9.