CVE-2021-22378 Race condition in eCNS280 TD

What is CVE-2021-22378?

CVE-2021-22378 is a medium-severity vulnerability in eCNS280_TD, published on 22 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

There is a race condition vulnerability in eCNS280_TD V100R005C00 and V100R005C10. There is a timing window exists in which the database can be operated by another thread that is operating concurrently. Successful exploit may cause the affected device abnormal.

Weakness: CWE-362

Which versions are affected by CVE-2021-22378?

It affects 1 product.

Products include Huawei Ecns280 Td Firmware.

How do I fix CVE-2021-22378?

No fix has been published for CVE-2021-22378 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-22378 being exploited?

There is no known exploitation of CVE-2021-22378 in the wild and no public exploit code.

Other vulnerabilities in eCNS280_TD

• CVE-2021-22396 Privilege escalation in eCNS280 TD;eSE620X vESS High 7.8
• CVE-2021-22363 Denial of service in eCNS280 TD High 7.5
• CVE-2021-40007 Information disclosure in eCNS280 TD Medium 6.5
• CVE-2021-39995 Denial of service in eCNS280 TD;eSE620X vESS Medium 6.5
• CVE-2021-37036 Information disclosure in FusionCompute;eCNS280 TD Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q93v-chpc-2r2m.