VulnerabilityModified

CVE-2021-22327

There is an arbitrary memory write vulnerability in Huawei smart phone when processing file parsing.

MEDIUM 6.5EPSS 0.53%

Does this matter?

Lower severity and a low EPSS score (0.53%). Track it; it rarely justifies an emergency change on its own.

Description

There is an arbitrary memory write vulnerability in Huawei smart phone when processing file parsing. Due to insufficient validation of the input files, successful exploit could cause certain service abnormal. Affected product versions include:HUAWEI P30 versions 10.0.0.186(C10E7R5P1), 10.0.0.186(C461E4R3P1), 10.0.0.188(C00E85R2P11), 10.0.0.188(C01E88R2P11),10.0.0.188(C605E19R1P3), 10.0.0.190(C185E4R7P1), 10.0.0.190(C431E22R2P5), 10.0.0.190(C432E22R2P5),10.0.0.190(C605E19R1P3), 10.0.0.190(C636E4R3P4), 10.0.0.192(C635E3R2P4).

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS: 0.53% probability · 44th percentile
CISA KEV: Not listed
Weakness: CWE-787
Affected: huawei/p30 firmware
Source: psirt@huawei.com

References

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210331-01-smartphone-enVendor Advisory
https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210331-01-smartphone-enVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.