Information disclosure in Huawei products - CVE-2021-40033

Vulnerability identifier: #VU59872

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-40033

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A local administrator can gain unauthorized access to sensitive information on the system.

Huawei CloudEngine 12800
Huawei CloudEngine 5800
Huawei CloudEngine 6800
Huawei CloudEngine 7800

Install updates from vendor's website.

Huawei CloudEngine 12800 - update to V200R005SPH021
Huawei CloudEngine 5800 - addressed in versions V200R005SPH021, V200R019SPH003
Huawei CloudEngine 6800 - addressed in versions V200R005SPH021, V200R019SPH003
Huawei CloudEngine 7800 - addressed in versions V200R005SPH021, V200R019SPH003

• https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20220112-01-infodis-en

• Information disclosure in Huawei CloudEngine products