CVSS: 9.0EPSS: 0%CPEs: 18EXPL: 0CVE-2021-37127
https://notcve.org/view.php?id=CVE-2021-37127
There is a signature management vulnerability in some huawei products. An attacker can forge signature and bypass the signature check. During firmware update process, successful exploit this vulnerability can cause the forged system file overwrite the correct system file. Affected product versions include:iManager NetEco V600R010C00CP2001,V600R010C00CP2002,V600R010C00SPC100,V600R010C00SPC110,V600R010C00SPC120,V600R010C00SPC200,V600R010C00SPC210,V600R010C00SPC300;iManager NetEco 6000 V600R009C00SPC100,V600R009C00SPC110,V600R009C00SPC120,V600R009C00SPC190,V600R009C00SPC200,V600R009C00SPC201,V600R009C00SPC202,V600R009C00SPC210. Se presenta una vulnerabilidad en la administración de firmas en algunos productos de Huawei. • https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211020-01-signature-en • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 6.8EPSS: 0%CPEs: 57EXPL: 0CVE-2021-37131
https://notcve.org/view.php?id=CVE-2021-37131
There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files to the target device. Se presenta una vulnerabilidad de inyección CSV en ManageOne, iManager NetEco e iManager NetEco 6000. Un atacante con altos privilegios puede explotar esta vulnerabilidad mediante algunas operaciones para inyectar los archivos CSV. • https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20211020-01-csv-en • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •