Huawei Fusioncompute vulnerabilities

21 CVEs affecting Huawei Fusioncompute, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-9236, published 2024-12-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-9242, published 2020-08-17. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. FusionCompute 8.0.0 have a command injection vulnerability. The software does not sufficiently validate certain parameters post from user, successful exploit could allow an authenticated attacker to…
CVE-2020-9116, published 2020-12-01. High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days. Huawei FusionCompute versions 6.5.1 and 8.0.0 have a command injection vulnerability. An authenticated, remote attacker can craft specific request to exploit this vulnerability. Due to insufficient…
CVE-2016-6827, published 2016-09-26. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Huawei FusionCompute before V100R005C10CP7002 stores cleartext AES keys in a file, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVE-2016-4057, published 2016-06-30. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Huawei FusionCompute before V100R005C10SPC700 allows remote authenticated users to cause a denial of service (resource consumption) via a large number of crafted packets.
CVE-2021-37102, published 2021-11-23. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. There is a command injection vulnerability in CMA service module of FusionCompute product when processing the default certificate file. The software constructs part of a command using external…
CVE-2021-37106, published 2021-09-28. High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days. There is a command injection vulnerability in CMA service module of FusionCompute 6.3.0, 6.3.1, 6.5.0 and 8.0.0 when processing the default certificate file. The software constructs part of a command…
CVE-2020-9228, published 2020-08-14. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. FusionCompute 8.0.0 has an information disclosure vulnerability. Due to the properly protection of certain information, attackers may exploit this vulnerability to obtain certain information.
CVE-2020-9233, published 2020-08-17. Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days. FusionCompute 8.0.0 have an insufficient authentication vulnerability. An attacker may exploit the vulnerability to delete some files and cause some services abnormal.
CVE-2021-37105, published 2021-09-28. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. There is an improper file upload control vulnerability in FusionCompute 6.5.0, 6.5.1 and 8.0.0. Due to the improper verification of file to be uploaded and does not strictly restrict the file access…
CVE-2020-9246, published 2020-08-21. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. FusionCompute 8.0.0 has an information leak vulnerability. A module does not launch strict access control and information protection. Attackers with low privilege can get some extra information. This…

Latest

CVE-2020-9236, published 2024-12-27. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. There is an improper interface design vulnerability in Huawei product. A module interface of the impated product does not deal with some operations properly. Attackers can exploit this vulnerability…
CVE-2020-9222, published 2024-12-27. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. There is a privilege escalation vulnerability in Huawei FusionCompute product. Due to insufficient verification on specific files that need to be deserialized, local attackers can exploit this…
CVE-2021-37036, published 2021-11-23. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. There is an information leakage vulnerability in FusionCompute 6.5.1, eCNS280_TD V100R005C00 and V100R005C10. Due to the improperly storage of specific information in the log file, the attacker can…
CVE-2021-22358, published 2021-05-27. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. There is an insufficient input validation vulnerability in FusionCompute 8.0.0. Due to the input validation is insufficient, an attacker can exploit this vulnerability to upload any files to the…
CVE-2020-9114, published 2020-12-01. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. FusionCompute versions 6.3.0, 6.3.1, 6.5.0, 6.5.1 and 8.0.0 have a privilege escalation vulnerability. Due to improper privilege management, an attacker with common privilege may access some specific…
CVE-2020-9128, published 2020-11-12. Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days. FusionCompute versions 8.0.0 have an insecure encryption algorithm vulnerability. Attackers with high permissions can exploit this vulnerability to cause information leak.