CVE-2021-22363 Denial of service in eCNS280 TD

What is CVE-2021-22363?

CVE-2021-22363 is a high-severity denial of service vulnerability in eCNS280_TD, published on 22 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

There is a resource management error vulnerability in eCNS280_TD V100R005C10SPC650. An attacker needs to perform specific operations to exploit the vulnerability on the affected device. Due to improper resource management of the function, the vulnerability can be exploited to cause service abnormal on affected devices.

Weakness: CWE-770

Which versions are affected by CVE-2021-22363?

It affects 1 product.

Products include Huawei Ecns280 Td Firmware.

How do I fix CVE-2021-22363?

No fix has been published for CVE-2021-22363 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-22363 being exploited?

There is no known exploitation of CVE-2021-22363 in the wild and no public exploit code.

Other vulnerabilities in eCNS280_TD

• CVE-2021-22396 Privilege escalation in eCNS280 TD;eSE620X vESS High 7.8
• CVE-2021-40007 Information disclosure in eCNS280 TD Medium 6.5
• CVE-2021-39995 Denial of service in eCNS280 TD;eSE620X vESS Medium 6.5
• CVE-2021-37036 Information disclosure in FusionCompute;eCNS280 TD Medium 5.5
• CVE-2021-22378 Race condition in eCNS280 TD Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f4h5-fx46-qjxf.