CVE-2021-33658

Published: Mar 11, 2022Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

atune before 0.3-0.8 log in as a local user and run the curl command to access the local atune url interface to escalate the local privilege or modify any file. Authentication is not forcibly enabled in the default configuration.

Affected (1)

Products: Huawei: Atune

Huawei

1 product

Atune

Configuration A

1 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Huawei Atune	From 0.3 to 0.8

Running on/with	Platform Versions
Openatom Openeuler	Version 20.03 sp1
Openatom Openeuler	Version 20.03 sp2
Openatom Openeuler	Version 20.03 sp3

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://www.openeuler.org/zh/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1541

Source: securities@openeuler.org

Vendor Advisory

https://www.openeuler.org/zh/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1541

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.