Skip to main content

Ecns280 Td Firmware CVE-2021-39995

MEDIUM
Out-of-bounds Read (CWE-125)
2021-11-29 psirt@huawei.com
Buffer Overflow Huawei Denial Of Service Information Disclosure Ecns280 Td Firmware Ese620X Vess Firmware
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Nov 29, 2021 - 16:15 nvd
MEDIUM 6.5

DescriptionNVD

Some Huawei products use the OpenHpi software for hardware management. A function that parses data returned by OpenHpi contains an out-of-bounds read vulnerability that could lead to a denial of service. Affected product versions include: eCNS280_TD V100R005C10; eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300.

AnalysisAI

Some Huawei products use the OpenHpi software for hardware management. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Out-of-bounds Read (CWE-125), which allows attackers to read data from memory outside the intended buffer boundaries. Some Huawei products use the OpenHpi software for hardware management. A function that parses data returned by OpenHpi contains an out-of-bounds read vulnerability that could lead to a denial of service. Affected product versions include: eCNS280_TD V100R005C10; eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300. Affected products include: Huawei Ecns280 Td Firmware, Huawei Ese620X Vess Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate array indices and buffer lengths. Use memory-safe languages. Enable AddressSanitizer during testing.

More in Ecns280 Td Firmware

View all
CVE-2021-22396 HIGH
7.8 Aug 02

There is a privilege escalation vulnerability in some Huawei products. Rated high severity (CVSS 7.8), this vulnerabilit
CVE-2021-22363 HIGH
7.5 Jun 22

There is a resource management error vulnerability in eCNS280_TD V100R005C10SPC650. Rated high severity (CVSS 7.5), this
CVE-2021-40007 MEDIUM
6.5 Dec 13

There is an information leak vulnerability in eCNS280_TD V100R005C10SPC650. Rated medium severity (CVSS 6.5), this vulne
CVE-2021-37036 MEDIUM
5.5 Nov 23

There is an information leakage vulnerability in FusionCompute 6.5.1, eCNS280_TD V100R005C00 and V100R005C10. Rated medi
CVE-2021-22378 MEDIUM
5.3 Jun 22

There is a race condition vulnerability in eCNS280_TD V100R005C00 and V100R005C10. Rated medium severity (CVSS 5.3), thi
CVE-2021-22383 MEDIUM
4.9 Jun 22

There is an out-of-bounds read vulnerability in eCNS280_TD V100R005C10 and eSE620X vESS V100R001C10SPC200, V100R001C20SP
CVE-2021-22300 MEDIUM
4.1 Feb 06

There is an information leak vulnerability in eCNS280_TD versions V100R005C00 and V100R005C10. Rated medium severity (CV

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2016-1646 HIGH POC
8.8
CVE-2025-5777 HIGH POC
7.5
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Share

CVE-2021-39995 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy