High severity · published Nov 23, 2021
CVE-2021-39976
There is a privilege escalation vulnerability in CloudEngine 5800 V200R020C00SPC600
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
There is a privilege escalation vulnerability in CloudEngine 5800 V200R020C00SPC600. Due to lack of privilege restrictions, an authenticated local attacker can perform specific operation to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C5
Cloudengine 5800 Firmware · Huawei
v200r020c00spc600 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-39976
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-39976
Vendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211103-01-privilege-en
More from Cloudengine 5800 Firmware
9.8
CVE-2017-17301
Huawei AR120-S V200R005C32, V200R006C10, V200R007C00, V200R008C20, AR1200 V200R005C20, V200R005C32, V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20, AR1200-S…
7.8
CVE-2020-9207
There is an improper authentication vulnerability in some verisons of Huawei CloudEngine product
7.5
CVE-2021-40008
There is a memory leak vulnerability in CloudEngine 12800 V200R019C00SPC800, CloudEngine 5800 V200R019C00SPC800, CloudEngine 6800 V200R019C00SPC800 and CloudEngine 7800…
7.5
CVE-2021-22328
There is a denial of service vulnerability in some huawei products
7.5
CVE-2021-22332
There is a pointer double free vulnerability in some versions of CloudEngine 5800, CloudEngine 6800, CloudEngine 7800 and CloudEngine 12800