CVE-2021-22396 Privilege escalation in eCNS280 TD;eSE620X vESS

High 7.8 Published 2 Aug 2021 Updated 3 Aug 2024

A local attacker can exploit improper privilege management to access specific files and escalate privileges on Huawei network devices.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-22396?

CVE-2021-22396 is a high-severity vulnerability in eCNS280_TD;eSE620X vESS, published on 2 Aug 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

There is a privilege escalation vulnerability in some Huawei products. Due to improper privilege management, a local attacker with common privilege may access some specific files in the affected products. Successful exploit will cause privilege escalation.Affected product versions include:eCNS280_TD V100R005C00,V100R005C10;eSE620X vESS V100R001C10SPC200,V100R001C20SPC200.

Weakness: CWE-269

Which versions are affected by CVE-2021-22396?

It affects 2 products.

Products include Huawei Ecns280 Td Firmware, Huawei Ese620x Vess Firmware.

How do I fix CVE-2021-22396?

No fix has been published for CVE-2021-22396 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-22396 being exploited?

There is no known exploitation of CVE-2021-22396 in the wild and no public exploit code.

Sources

Also known as GHSA-rg9j-p47f-47fq.