CVE-2021-37036 Information disclosure in FusionCompute;eCNS280 TD

Medium 5.5 Published 23 Nov 2021 Updated 4 Aug 2024

Attackers can obtain sensitive information from log files when users log in to Huawei FusionCompute or eCNS280_TD devices.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-37036?

CVE-2021-37036 is a medium-severity vulnerability in FusionCompute;eCNS280_TD, published on 23 Nov 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

There is an information leakage vulnerability in FusionCompute 6.5.1, eCNS280_TD V100R005C00 and V100R005C10. Due to the improperly storage of specific information in the log file, the attacker can obtain the information when a user logs in to the device. Successful exploit may cause the information leak.

Weakness: CWE-532

Which versions are affected by CVE-2021-37036?

It affects 2 products.

Products include Huawei Ecns280 Td Firmware, Huawei Fusioncompute.

How do I fix CVE-2021-37036?

No fix has been published for CVE-2021-37036 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-37036 being exploited?

There is no known exploitation of CVE-2021-37036 in the wild and no public exploit code.

Sources

Also known as GHSA-vx48-mxh7-h8m4.