Huawei ECNS280 Td Firmware vulnerabilities

8 CVEs affecting Huawei ECNS280 Td Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-40007, published 2021-12-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-22363, published 2021-06-22. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. There is a resource management error vulnerability in eCNS280_TD V100R005C10SPC650. An attacker needs to perform specific operations to exploit the vulnerability on the affected device. Due to…
CVE-2021-22383, published 2021-06-22. Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days. There is an out-of-bounds read vulnerability in eCNS280_TD V100R005C10 and eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300. The vulnerability is due to a message-handling…
CVE-2021-39995, published 2021-11-29. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Some Huawei products use the OpenHpi software for hardware management. A function that parses data returned by OpenHpi contains an out-of-bounds read vulnerability that could lead to a denial of…
CVE-2021-40007, published 2021-12-13. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. There is an information leak vulnerability in eCNS280_TD V100R005C10SPC650. The vulnerability is caused by improper log output management. An attacker with the ability to access the log file of…
CVE-2021-22378, published 2021-06-22. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. There is a race condition vulnerability in eCNS280_TD V100R005C00 and V100R005C10. There is a timing window exists in which the database can be operated by another thread that is operating…
CVE-2021-37036, published 2021-11-23. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. There is an information leakage vulnerability in FusionCompute 6.5.1, eCNS280_TD V100R005C00 and V100R005C10. Due to the improperly storage of specific information in the log file, the attacker can…
CVE-2021-22396, published 2021-08-02. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. There is a privilege escalation vulnerability in some Huawei products. Due to improper privilege management, a local attacker with common privilege may access some specific files in the affected…
CVE-2021-22300, published 2021-02-06. Medium severity, CVSS 4.1. EPSS: 0.1% chance of exploitation in the next 30 days. There is an information leak vulnerability in eCNS280_TD versions V100R005C00 and V100R005C10. A command does not have timeout exit mechanism. Temporary file contains sensitive information. This…