CVE-2021-22382 Missing authorization in E3372
An attacker can perform unauthenticated operations on Huawei LTE USB Dongles by inducing a user to install a malicious application locally.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-22382?
CVE-2021-22382 is a medium-severity missing authorization vulnerability in E3372, published on 22 Jun 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Huawei LTE USB Dongle products have an improper permission assignment vulnerability. An attacker can locally access and log in to a PC to induce a user to install a specially crafted application. After successfully exploiting this vulnerability, the attacker can perform unauthenticated operations. Affected product versions include:E3372 E3372h-153TCPU-V200R002B333D01SP00C00.
Weakness: CWE-281
Which versions are affected by CVE-2021-22382?
It affects 2 products.
Products include Huawei E3372 Firmware, Huawei E8372 Firmware.
How do I fix CVE-2021-22382?
No fix has been published for CVE-2021-22382 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-22382 being exploited?
There is no known exploitation of CVE-2021-22382 in the wild and no public exploit code.
Sources
Also known as GHSA-5j5j-gh4v-9q6c.