Medium severity · published Aug 13, 2021
CVE-2021-37028
There is a command injection vulnerability in the HG8045Q product
6.7
CVSS
0.3%
EPSS
No
On KEV
Description
There is a command injection vulnerability in the HG8045Q product. When the command-line interface is enabled, which is disabled by default, attackers with administrator privilege could execute part of commands.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EH
EchoLife HG8045Q ·
V300R016C00,V300R018C10 · source: vendor
HF
Hg8045q Firmware · Huawei
v300r016c00spc110; v300r018c10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-37028
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-37028
Third Party Advisory
http://jvn.jp/en/jp/JVN41646618/index.html
Permissions Required
https://support.huawei.com/carrier/navi?coltype=software#col=software&from=product&detailId=PBI1-252279599&path=PBI1-252301455/PBI1-252303293/PBI1-23709862/PBI1-22318696/PBI1-21457383