CVE-2021-37101

There is an improper authorization vulnerability in AIS-BW50-00 9.0.6.2(H100SP10C00) and 9.0.6.2(H100SP15C00). Due to improper authorization mangement, an attakcer can exploit this vulnerability by physical accessing the device and implant malicious code. Successfully exploit could leads to arbitrary code execution in the target device.

CVSS v3 6.8 MEDIUM
CVSS v2.0 7.2 HIGH

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210908-01-badauthorization-en	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:huawei:ais-bw50-00_firmware:9.0.6.2\(h100sp10c00\):::::::*
	cpe:2.3:o:huawei:ais-bw50-00_firmware:9.0.6.2\(h100sp15c00\):::::::*

cpe:2.3:h:huawei:ais-bw50-00:-:*:*:*:*:*:*:*

History

03 May 2022, 16:04

Type	Values Removed	Values Added
CWE	~~CWE-863~~	NVD-CWE-Other

24 Sep 2021, 20:20

Type	Values Removed	Values Added
CWE		CWE-863
CPE		cpe:2.3:o:huawei:ais-bw50-00_firmware:9.0.6.2\(h100sp10c00\):::::::* cpe:2.3:h:huawei:ais-bw50-00:-:::::::* cpe:2.3:o:huawei:ais-bw50-00_firmware:9.0.6.2\(h100sp15c00\):::::::*
References	~~(MISC) https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210908-01-badauthorization-en -~~	(MISC) https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210908-01-badauthorization-en - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 7.2 v3 : 6.8

09 Sep 2021, 15:50

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-09-09 14:15

Updated : 2024-02-04 22:08

NVD link : CVE-2021-37101

Mitre link : CVE-2021-37101

CVE.ORG link : CVE-2021-37101

JSON object : View

Products Affected

huawei

ais-bw50-00_firmware
ais-bw50-00

CWE

NVD-CWE-Other

{"id": "CVE-2021-37101", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "published": "2021-09-09T14:15:08.780", "references": [{"url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210908-01-badauthorization-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "There is an improper authorization vulnerability in AIS-BW50-00 9.0.6.2(H100SP10C00) and 9.0.6.2(H100SP15C00). Due to improper authorization mangement, an attakcer can exploit this vulnerability by physical accessing the device and implant malicious code. Successfully exploit could leads to arbitrary code execution in the target device."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de autorizaci\u00f3n inapropiada en AIS-BW50-00 versiones 9.0.6.2(H100SP10C00) y 9.0.6.2(H100SP15C00). Debido a una administraci\u00f3n inapropiada de la autorizaci\u00f3n, un atacante puede explotar esta vulnerabilidad accediendo f\u00edsicamente al dispositivo e implantando c\u00f3digo malicioso. Una explotaci\u00f3n con \u00e9xito podr\u00eda conllevar a una ejecuci\u00f3n de c\u00f3digo arbitrario en el dispositivo de destino"}], "lastModified": "2022-05-03T16:04:40.443", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:ais-bw50-00_firmware:9.0.6.2\\(h100sp10c00\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "516D3861-68A7-44DE-8F15-06611E9BAF50"}, {"criteria": "cpe:2.3:o:huawei:ais-bw50-00_firmware:9.0.6.2\\(h100sp15c00\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EECFD508-15BD-4B74-BCB8-05BCDEFD4AED"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:ais-bw50-00:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2213030F-6DBC-45A1-85D9-6676653109F0"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}