CVE-2021-22411

MEDIUM

Huawei NGFW Module <5.0.5 - Buffer Overflow

Title source: llm
STIX 2.1

Description

There is an out-of-bounds write vulnerability in some Huawei products. The code of a module have a bad judgment logic. Attackers can exploit this vulnerability by performing multiple abnormal activities to trigger the bad logic and cause out-of-bounds write. This may compromise the normal service of the module.Affected product versions include: NGFW Module versions V500R005C00SPC100,V500R005C00SPC200;Secospace USG6300 versions V500R001C30SPC200,V500R001C30SPC600,V500R001C60SPC500,V500R005C00SPC100,V500R005C00SPC200;Secospace USG6500 versions V500R001C30SPC200,V500R001C30SPC600,V500R001C60SPC500,V500R005C00SPC100,V500R005C00SPC200;Secospace USG6600 versions V500R001C30SPC200,V500R001C30SPC600,V500R001C60SPC500,V500R005C00SPC100,V500R005C00SPC200;USG9500 versions V500R001C60SPC500,V500R005C00SPC100,V500R005C00SPC200.

References (1)

Core 1

Scores

CVSS v3 6.5
EPSS 0.0017
EPSS Percentile 38.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-787
Status published
Products (20)
huawei/ngfw_module_firmware v500r005c00spc100
huawei/ngfw_module_firmware v500r005c00spc200
huawei/secospace_usg6300_firmware v500r001c30spc200
huawei/secospace_usg6300_firmware v500r001c30spc600
huawei/secospace_usg6300_firmware v500r001c60spc500
huawei/secospace_usg6300_firmware v500r005c00spc100
huawei/secospace_usg6300_firmware v500r005c00spc200
huawei/secospace_usg6500_firmware v500r001c30spc200
huawei/secospace_usg6500_firmware v500r001c30spc600
huawei/secospace_usg6500_firmware v500r001c60spc500
... and 10 more
Published May 27, 2021
Tracked Since Feb 18, 2026