This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Huawei First view 2021-02-06
Product ecns280 Td Firmware Last view 2021-12-13
Version Type Os
Update  
Edition  
Language  
Sofware Edition  
Target Software  
Target Hardware  
Other  

Activity : Overall

COMMON PLATFORM ENUMERATION: Repartition per Version

CPE Name Affected CVE
cpe:2.3:o:huawei:ecns280_td_firmware:v100r005c10:*:*:*:*:*:*:* 6
cpe:2.3:o:huawei:ecns280_td_firmware:v100r005c00:*:*:*:*:*:*:* 4
cpe:2.3:o:huawei:ecns280_td_firmware:v100r005c10spc650:*:*:*:*:*:*:* 2

Related : CVE

  Date Alert Description
6.5 2021-12-13 CVE-2021-40007

There is an information leak vulnerability in eCNS280_TD V100R005C10SPC650. The vulnerability is caused by improper log output management. An attacker with the ability to access the log file of device may lead to information disclosure.

6.5 2021-11-29 CVE-2021-39995

Some Huawei products use the OpenHpi software for hardware management. A function that parses data returned by OpenHpi contains an out-of-bounds read vulnerability that could lead to a denial of service. Affected product versions include: eCNS280_TD V100R005C10; eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300.

5.5 2021-11-23 CVE-2021-37036

There is an information leakage vulnerability in FusionCompute 6.5.1, eCNS280_TD V100R005C00 and V100R005C10. Due to the improperly storage of specific information in the log file, the attacker can obtain the information when a user logs in to the device. Successful exploit may cause the information leak.

7.8 2021-08-02 CVE-2021-22396

There is a privilege escalation vulnerability in some Huawei products. Due to improper privilege management, a local attacker with common privilege may access some specific files in the affected products. Successful exploit will cause privilege escalation.Affected product versions include:eCNS280_TD V100R005C00,V100R005C10;eSE620X vESS V100R001C10SPC200,V100R001C20SPC200.

4.9 2021-06-22 CVE-2021-22383

There is an out-of-bounds read vulnerability in eCNS280_TD V100R005C10 and eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300. The vulnerability is due to a message-handling function that contains an out-of-bounds read vulnerability. An attacker can exploit this vulnerability by sending a specific message to the target device, which could cause a Denial of Service (DoS).

5.3 2021-06-22 CVE-2021-22378

There is a race condition vulnerability in eCNS280_TD V100R005C00 and V100R005C10. There is a timing window exists in which the database can be operated by another thread that is operating concurrently. Successful exploit may cause the affected device abnormal.

7.5 2021-06-22 CVE-2021-22363

There is a resource management error vulnerability in eCNS280_TD V100R005C10SPC650. An attacker needs to perform specific operations to exploit the vulnerability on the affected device. Due to improper resource management of the function, the vulnerability can be exploited to cause service abnormal on affected devices.

4.1 2021-02-06 CVE-2021-22300

There is an information leak vulnerability in eCNS280_TD versions V100R005C00 and V100R005C10. A command does not have timeout exit mechanism. Temporary file contains sensitive information. This allows attackers to obtain information by inter-process access that requires other methods.

CWE : Common Weakness Enumeration

%idName
25% (2) CWE-125 Out-of-bounds Read
12% (1) CWE-770 Allocation of Resources Without Limits or Throttling
12% (1) CWE-532 Information Leak Through Log Files
12% (1) CWE-362 Race Condition
12% (1) CWE-312 Cleartext Storage of Sensitive Information
12% (1) CWE-269 Improper Privilege Management
12% (1) CWE-116 Improper Encoding or Escaping of Output