CVE-2021-37127 Security feature bypass in iManager NetEco;iManager NetEco 6000
Attackers can bypass firmware signature checks to overwrite system files, potentially leading to code execution or privilege escalation in Huawei iManager NetEco.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-37127?
CVE-2021-37127 is a high-severity vulnerability in iManager NetEco;iManager NetEco 6000, published on 27 Oct 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
There is a signature management vulnerability in some huawei products. An attacker can forge signature and bypass the signature check. During firmware update process, successful exploit this vulnerability can cause the forged system file overwrite the correct system file. Affected product versions include:iManager NetEco V600R010C00CP2001,V600R010C00CP2002,V600R010C00SPC100,V600R010C00SPC110,V600R010C00SPC120,V600R010C00SPC200,V600R010C00SPC210,V600R010C00SPC300;iManager NetEco 6000 V600R009C00SPC100,V600R009C00SPC110,V600R009C00SPC120,V600R009C00SPC190,V600R009C00SPC200,V600R009C00SPC201,V600R009C00SPC202,V600R009C00SPC210.
Weakness: CWE-347
Which versions are affected by CVE-2021-37127?
It affects 2 products.
Products include Huawei Imanager Neteco 6000 Firmware, Huawei Imanager Neteco Firmware.
How do I fix CVE-2021-37127?
No fix has been published for CVE-2021-37127 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-37127 being exploited?
There is no known exploitation of CVE-2021-37127 in the wild and no public exploit code.
Sources
Also known as GHSA-929h-mg2v-7c23.