CVE-2021-22312

Medium

Published: 08 April 2021

Published

08 April 2021

Modified

21 November 2024

KEV Added

—

Patch

—

CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0018 39.7th percentile

Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-22312 is a medium-severity Missing Release of Memory after Effective Lifetime (CWE-401) vulnerability in Huawei Secospace Usg6300 Firmware. Its CVSS base score is 6.5 (Medium).

Operationally, ranked at the 39.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2021-9458

Vulnerability details

There is a memory leak vulnerability in some Huawei products. An authenticated remote attacker may exploit this vulnerability by sending specific message to the affected product. Due to not release the allocated memory properly, successful exploit may cause some service…

abnormal. Affected product include some versions of IPS Module, NGFW Module, Secospace USG6300, Secospace USG6500, Secospace USG6600 and USG9500.

CWE(s): CWE-401

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

huawei

ips module firmware

v500r005c00spc100, v500r005c00spc200

huawei

ngfw module firmware

v500r005c00spc100, v500r005c00spc200

huawei

secospace usg6300 firmware