CVE-2021-22439 Deserialization in AnyOffice
An attacker can execute remote malicious code and control the device via a deserialization vulnerability in Huawei AnyOffice.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22439?
CVE-2021-22439 is a high-severity unsafe deserialization vulnerability in AnyOffice, published on 29 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There is a deserialization vulnerability in Huawei AnyOffice V200R006C10. An attacker can construct a specific request to exploit this vulnerability. Successfully exploiting this vulnerability, the attacker can execute remote malicious code injection and to control the device.
Weakness: CWE-502
Which versions are affected by CVE-2021-22439?
It affects 1 product.
Products include Huawei Anyoffice.
How do I fix CVE-2021-22439?
No fix has been published for CVE-2021-22439 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2021-22439 being exploited?
There is no known exploitation of CVE-2021-22439 in the wild and no public exploit code.
Other vulnerabilities in AnyOffice
Sources
Also known as GHSA-mv3h-rm7m-83qx.