Read the docs
TI-2021-05370 Aliases CVE-2021-22397GHSA-4g2x-v66g-vw9g

Improper input validation in ManageOne

Priority LOW 29CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

There is a privilege escalation vulnerability in Huawei ManageOne 8.0.0. External parameters of some files are lack of verification when they are be called. Attackers can exploit this vulnerability by performing these files to cause privilege escalation attack. This can compromise normal service.

Why it matters now

EPSS 0.00173 6th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—ManageOne8.0.0—No fix listedCNA
  • ManageOne Vendor— Affected 8.0.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:huawei:manageone:8.0.0:-:*:*:*:*:*:*8.0.0VulnerableHuawei
  • cpe:2.3:a:huawei:manageone:8.0.0:-:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Huawei

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22397
  2. 2026-10-03 Alias added: GHSA-4g2x-v66g-vw9g

References

Advisory 1

  • TI-2021-05269 Some Huawei products have an inconsistent interpretation of HTTP requests vulnerability. CVSS 3.1HIGH 7.5
  • TI-2019-11040 Buffer overflow in Linux kernel CVSS 3.1HIGH 7.8
  • TI-2021-05274 There is a local privilege escalation vulnerability in some Huawei products. CVSS 3.1HIGH 7.8
  • TI-2020-07326 Improper input validation in ManageOne CVSS 3.1HIGH 7.2
  • TI-2019-03718 Out-of-bounds read in ManageOne CVSS 3.1HIGH 7.5
  • TI-2021-05289 There is a local privilege escalation vulnerability in some versions of ManageOne. CVSS 3.1HIGH 7.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences