CVE-2021-37129 Memory corruption in IIPS Module;NGFW Module;NIP6600;S12700;S1700;S2700;S5700;S6700;S7700;S9700;USG9500
An out-of-bounds write vulnerability in Huawei network devices allows attackers to cause a denial of service condition.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-37129?
CVE-2021-37129 is a high-severity memory corruption vulnerability in Huawei Ips Module Firmware, published on 27 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There is an out of bounds write vulnerability in some Huawei products. The vulnerability is caused by a function of a module that does not properly verify input parameter. Successful exploit could cause out of bounds write leading to a denial of service condition.Affected product versions include:IPS Module V500R005C00,V500R005C20;NGFW Module V500R005C00;NIP6600 V500R005C00,V500R005C20;S12700 V200R010C00SPC600,V200R011C10SPC500,V200R011C10SPC600,V200R013C00SPC500,V200R019C00SPC200,V200R019C00SPC500,V200R019C10SPC200,V200R020C00,V200R020C10;S1700 V200R010C00SPC600,V200R011C10SPC500,V200R011C10SPC600;S2700 V200R010C00SPC600,V200R011C10SPC500,V200R011C10SPC600;S5700 V200R010C00SPC600,V200R010C00SPC700,V200R011C10SPC500,V200R011C10SPC600,V200R019C00SPC500;S6700 V200R010C00SPC600,V200R011C10SPC500,V200R011C10SPC600;S7700 V200R010C00SPC600,V200R010C00SPC700,V200R011C10SPC500,V200R011C10SPC600;S9700 V200R010C00SPC600,V200R011C10SPC500,V200R011C10SPC600;USG9500 V500R005C00,V500R005C20.
Weakness: CWE-787
Which versions are affected by CVE-2021-37129?
It affects 11 products.
Products include Huawei Ips Module Firmware, Huawei Ngfw Module Firmware, Huawei Nip6600 Firmware, Huawei S12700 Firmware, Huawei S1700 Firmware, Huawei S2700 Firmware and 5 more.
How do I fix CVE-2021-37129?
No fix has been published for CVE-2021-37129 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-37129 being exploited?
There is no known exploitation of CVE-2021-37129 in the wild and no public exploit code.
Other vulnerabilities in Huawei Ips Module Firmware
- CVE-2020-9099 Auth bypass in IPS Module; NGFW Module; NIP6300; NIP6600; NIP6800; Secospace USG6300; Secospace USG6500; Secospace USG6600; USG9500
- CVE-2016-4576 Memory corruption in n/a
- CVE-2021-22320 Denial of service in IPS Module;NGFW Module;NIP6600;NIP6800;Secospace USG6300;Secospace USG6500;Secospace USG6600
- CVE-2017-15348 Denial of service in IPS Module,NGFW Module,NIP6300,NIP6600,Secospace USG6300,Secospace USG6500,Secospace USG6600,USG9500,
- CVE-2017-17153 Denial of service in IPS,Module,NGFW,Module,NIP6300,NIP6600,Secospace,USG6300,Secospace,USG6500,Secospace,USG6600,USG9500
Sources
Also known as GHSA-53hh-mvr7-x3hp.