Strix
26.1K

CVE-2021-22356

MEDIUMCVSS 5.9/10EPSS 0.40%

Last modified

CVE-2021-22356 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. There is a weak secure algorithm vulnerability in Huawei products. A weak secure algorithm is used in a module. EPSS estimates a 0.40% chance of exploitation in the next 30 days.

Description

There is a weak secure algorithm vulnerability in Huawei products. A weak secure algorithm is used in a module. Attackers can exploit this vulnerability by capturing and analyzing the messages between devices to obtain information. This can lead to information leak.Affected product versions include: IPS Module V500R005C00SPC100, V500R005C00SPC200; NGFW Module V500R005C00SPC100, V500R005C00SPC200; Secospace USG6300 V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200; Secospace USG6500 V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200; Secospace USG6600 V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200; USG9500 V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200.

Metrics

CVSS 3.1
5.9/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability
0.40%

32.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
HuaweiIps Module Firmwarev500r005c00spc100
HuaweiIps Module Firmwarev500r005c00spc200
HuaweiNgfw Module Firmwarev500r005c00spc100
HuaweiNgfw Module Firmwarev500r005c00spc200
HuaweiSecospace Usg6300 Firmwarev500r001c30spc200
HuaweiSecospace Usg6300 Firmwarev500r001c30spc600
HuaweiSecospace Usg6300 Firmwarev500r001c60spc500
HuaweiSecospace Usg6300 Firmwarev500r005c00spc100
HuaweiSecospace Usg6300 Firmwarev500r005c00spc200
HuaweiSecospace Usg6500 Firmwarev500r001c30spc200
HuaweiSecospace Usg6500 Firmwarev500r001c30spc600
HuaweiSecospace Usg6500 Firmwarev500r001c60spc500
HuaweiSecospace Usg6500 Firmwarev500r005c00spc100
HuaweiSecospace Usg6500 Firmwarev500r005c00spc200
HuaweiSecospace Usg6600 Firmwarev500r001c30spc200
HuaweiSecospace Usg6600 Firmwarev500r001c30spc600
HuaweiSecospace Usg6600 Firmwarev500r001c60spc500
HuaweiSecospace Usg6600 Firmwarev500r005c00spc100
HuaweiSecospace Usg6600 Firmwarev500r005c00spc200
HuaweiUsg9500 Firmwarev500r001c30spc200
HuaweiUsg9500 Firmwarev500r001c30spc600
HuaweiUsg9500 Firmwarev500r001c60spc500
HuaweiUsg9500 Firmwarev500r005c00spc100
HuaweiUsg9500 Firmwarev500r005c00spc200

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-22356?
There is a weak secure algorithm vulnerability in Huawei products. A weak secure algorithm is used in a module. Attackers can exploit this vulnerability by capturing and analyzing the messages between devices to obtain information. This can lead to information leak.Affected product versions include: IPS Module V500R005C00SPC100, V500R005C00SPC200; NGFW Module V500R005C00SPC100, V500R005C00SPC200; Secospace USG6300 V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200; Secospace USG6500 V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200; Secospace USG6600 V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200; USG9500 V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200.
How severe is CVE-2021-22356?
CVE-2021-22356 has a CVSS score of 5.9/10 (MEDIUM severity). The EPSS model estimates a 0.40% probability of exploitation in the next 30 days.
How do I fix CVE-2021-22356?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-22356?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST