CVE-2021-37106 Command injection in FusionCompute

High 7.2 Published 28 Sep 2021 Updated 4 Aug 2024

Attackers can inject commands via the default certificate file in FusionCompute, leading to arbitrary code execution on the system.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-37106?

CVE-2021-37106 is a high-severity command injection vulnerability in FusionCompute, published on 28 Sep 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

There is a command injection vulnerability in CMA service module of FusionCompute 6.3.0, 6.3.1, 6.5.0 and 8.0.0 when processing the default certificate file. The software constructs part of a command using external special input from users, but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands to the system.

Weakness: CWE-77

Which versions are affected by CVE-2021-37106?

It affects 1 product.

Products include Huawei Fusioncompute.

How do I fix CVE-2021-37106?

No fix has been published for CVE-2021-37106 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2021-37106 being exploited?

There is no known exploitation of CVE-2021-37106 in the wild and no public exploit code.

Sources

Also known as GHSA-2r4h-9r32-83xj.