Cyber Resilience

CVE-2021-37129

High

Published: 27 October 2021

Published
27 October 2021
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0018 39.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-37129 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Huawei S12700 Firmware. Its CVSS base score is 7.5 (High).

Operationally, ranked at the 39.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

There is an out of bounds write vulnerability in some Huawei products. The vulnerability is caused by a function of a module that does not properly verify input parameter. Successful exploit could cause out of bounds write leading to a…

more

denial of service condition.Affected product versions include:IPS Module V500R005C00,V500R005C20;NGFW Module V500R005C00;NIP6600 V500R005C00,V500R005C20;S12700 V200R010C00SPC600,V200R011C10SPC500,V200R011C10SPC600,V200R013C00SPC500,V200R019C00SPC200,V200R019C00SPC500,V200R019C10SPC200,V200R020C00,V200R020C10;S1700 V200R010C00SPC600,V200R011C10SPC500,V200R011C10SPC600;S2700 V200R010C00SPC600,V200R011C10SPC500,V200R011C10SPC600;S5700 V200R010C00SPC600,V200R010C00SPC700,V200R011C10SPC500,V200R011C10SPC600,V200R019C00SPC500;S6700 V200R010C00SPC600,V200R011C10SPC500,V200R011C10SPC600;S7700 V200R010C00SPC600,V200R010C00SPC700,V200R011C10SPC500,V200R011C10SPC600;S9700 V200R010C00SPC600,V200R011C10SPC500,V200R011C10SPC600;USG9500 V500R005C00,V500R005C20.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

huawei
ips module firmware
v500r005c00, v500r005c20
huawei
ngfw module firmware
v500r005c00
huawei
nip6600 firmware
v500r005c00, v500r005c20
huawei
s12700 firmware
v200r010c00spc600, v200r011c10spc500, v200r011c10spc600, v200r013c00spc500, v200r019c00spc200
huawei
s1700 firmware
v200r010c00spc600, v200r011c10spc500, v200r011c10spc600
huawei
s2700 firmware
v200r010c00spc600, v200r011c10spc500, v200r011c10spc600
huawei
s5700 firmware
v200r010c00spc600, v200r010c00spc700, v200r011c10spc500, v200r011c10spc600, v200r019c00spc500
huawei
s6700 firmware
v200r010c00spc600, v200r011c10spc500, v200r011c10spc600
huawei
s7700 firmware
v200r010c00spc600, v200r010c00spc700, v200r011c10spc500, v200r011c10spc600
huawei
s9700 firmware
v200r010c00spc600, v200r011c10spc500, v200r011c10spc600
+1 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-787

Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.

References