Read the docs
TI-2021-15102 Aliases CVE-2021-37028GHSA-hghr-6gj9-99m4

OS command injection in EchoLife HG8045Q

Priority LOW 30CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

There is a command injection vulnerability in the HG8045Q product. When the command-line interface is enabled, which is disabled by default, attackers with administrator privilege could execute part of commands.

Why it matters now

EPSS 0.00347 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—EchoLife HG8045QV300R016C00,V300R018C10—No fix listedCNA
  • EchoLife HG8045Q Vendor— Affected V300R016C00,V300R018C10 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:huawei:hg8045q_firmware:v300r016c00spc110:*:*:*:*:*:*:*v300r016c00spc110VulnerableHuawei
cpe:2.3:o:huawei:hg8045q_firmware:v300r018c10:*:*:*:*:*:*:*v300r018c10VulnerableHuawei
cpe:2.3:h:huawei:hg8045q:-:*:*:*:*:*:*:*not specified by NVDRunning onHuawei
  • cpe:2.3:o:huawei:hg8045q_firmware:v300r016c00spc110:*:*:*:*:*:*:* Versions v300r016c00spc110 Vulnerable ·Huawei
  • cpe:2.3:o:huawei:hg8045q_firmware:v300r018c10:*:*:*:*:*:*:* Versions v300r018c10 Vulnerable ·Huawei
  • cpe:2.3:h:huawei:hg8045q:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-37028
  2. 2026-10-03 Alias added: GHSA-hghr-6gj9-99m4

References

Advisory 2

  • TI-2018-05718 Information disclosure in Huawei some HG products CVSS 3.0MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences