Skip to main content

S7700 Firmware CVE-2021-22321

MEDIUM
Use After Free (CWE-416)
2021-03-22 psirt@huawei.com
Information Disclosure Use After Free Memory Corruption Huawei S7700 Firmware S12700 Firmware S2700 Firmware S6700 Firmware S5700 Firmware S9700 Firmware Nip6300 Firmware Secospace Usg6500 Firmware Usg9500 Firmware Secospace Usg6300 Firmware Secospace Usg6600 Firmware Nip6600 Firmware S1700 Firmware Nip6800 Firmware
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

1
CVE Published
Mar 22, 2021 - 20:15 nvd
MEDIUM 5.3

DescriptionNVD

There is a use-after-free vulnerability in a Huawei product. A module cannot deal with specific operations in special scenarios. Attackers can exploit this vulnerability by performing malicious operations. This can cause memory use-after-free, compromising normal service. Affected product include some versions of NIP6300, NIP6600, NIP6800, S1700, S2700, S5700, S6700 , S7700, S9700, Secospace USG6300, Secospace USG6500, Secospace USG6600 and USG9500.

AnalysisAI

There is a use-after-free vulnerability in a Huawei product. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Use After Free (CWE-416), which allows attackers to access freed memory to execute arbitrary code or crash the application. There is a use-after-free vulnerability in a Huawei product. A module cannot deal with specific operations in special scenarios. Attackers can exploit this vulnerability by performing malicious operations. This can cause memory use-after-free, compromising normal service. Affected product include some versions of NIP6300, NIP6600, NIP6800, S1700, S2700, S5700, S6700 , S7700, S9700, Secospace USG6300, Secospace USG6500, Secospace USG6600 and USG9500. Affected products include: Huawei Nip6300 Firmware, Huawei Nip6600 Firmware, Huawei Nip6800 Firmware, Huawei S12700 Firmware, Huawei S1700 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use smart pointers or garbage-collected languages. Set pointers to NULL after freeing. Enable memory sanitizers.

More in S7700 Firmware

View all
CVE-2015-2808 LOW
3.7 Apr 01

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data duri
CVE-2015-2800 HIGH
7.5 Jun 08

The user authentication module in Huawei Campus switches S5700, S5300, S6300, and S6700 with software before V200R001SPH
CVE-2016-6518 HIGH
7.5 Sep 26

Memory leak in Huawei S9300, S5300, S5700, S6700, S7700, S9700, and S12700 devices allows remote attackers to cause a de
CVE-2015-3913 HIGH
7.5 Jun 08

The IP stack in multiple Huawei Campus series switch models allows remote attackers to cause a denial of service (reboot
CVE-2014-8572 HIGH
7.5 Apr 02

Huawei AC6605 with software V200R001C00; AC6605 with software V200R002C00; ACU with software V200R001C00; ACU with softw
CVE-2015-8676 HIGH
7.5 Apr 14

Memory leak in Huawei S5300EI, S5300SI, S5310HI, S6300EI/ S2350EI, and S5300LI Campus series switches with software V200
CVE-2016-3678 HIGH
7.5 Apr 11

Huawei Quidway S9700, S5700, S5300, S9300, and S7700 switches with software before V200R003SPH012 allow remote attackers
CVE-2016-8797 HIGH
7.5 Apr 02

Huawei AR3200 with software V200R007C00, V200R005C32, V200R005C20; S12700 with software V200R008C00, V200R007C00; S5300

CVE-2016-8773 HIGH
7.5 Apr 02

Huawei S5300 with software V200R003C00, V200R007C00, V200R008C00, V200R009C00; S5700 with software V200R001C00, V200R002
CVE-2014-4706 HIGH
7.5 Apr 02

Huawei Campus S3700HI with software V200R001C00SPC300; Campus S5700 with software V200R002C00SPC100; Campus S7700 with s
CVE-2016-2404 HIGH
7.5 Apr 02

Huawei switches S5700, S6700, S7700, S9700 with software V200R001C00SPC300, V200R002C00SPC100, V200R003C00SPC300, V200R0
CVE-2017-8147 HIGH
7.5 Nov 22

AC6005 V200R006C10SPC200,AC6605 V200R006C10SPC200,AR1200 with software V200R005C10CP0582T, V200R005C10HP0581T, V200R005C

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2021-22321 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy