CVE-2021-39976

Vulnerability

A privilege escalation vulnerability exists in Huawei CloudEngine 5800 V200R020C00SPC600. Due to a lack of privilege restrictions, an authenticated local attacker can exploit this flaw. The affected version is V200R020C00SPC600, as identified in the advisory [1].

Exploitation

An authenticated local attacker can perform a specific (unspecified in the available references) operation to trigger the vulnerability. No user interaction beyond local authentication is required; the attacker needs local access to an affected device [1].

Impact

Successful exploitation allows the attacker to obtain a higher privilege than originally granted, leading to privilege escalation within the affected device. The exact elevated privilege level is not detailed in the references [1].

Mitigation

Huawei has released software updates to fix this vulnerability. Resolved versions include V200R005C10SPH037 and V200R019C10SPC800+V200R019C10SPH011, among others. Customers should upgrade to the corresponding resolved product version as listed in the security advisory [1]. No workaround is provided in the references.