Cross-site scripting in WS318n-21
Priority LOW 19CWE-79Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
There is a Cross-Site Scripting(XSS) vulnerability in HUAWEI WS318n product when processing network settings. Due to insufficient validation of user input, a local authenticated attacker could exploit this vulnerability by injecting special characters. Successful exploit could cause certain information disclosure. Affected product versions include: WS318n-21 10.0.2.2, 10.0.2.5 and 10.0.2.6.
Why it matters now
EPSS 0.00174 6th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | WS318n-21 | 10.0.2.2; 10.0.2.5; 10.0.2.6 | — | No fix listed | CNA |
- WS318n-21 Vendor— Affected 10.0.2.2; 10.0.2.5; 10.0.2.6 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:ws318n-21_firmware:10.0.2.2:*:*:*:*:*:*:* | 10.0.2.2 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:ws318n-21_firmware:10.0.2.5:*:*:*:*:*:*:* | 10.0.2.5 | Vulnerable | Huawei |
| cpe:2.3:o:huawei:ws318n-21_firmware:10.0.2.6:*:*:*:*:*:*:* | 10.0.2.6 | Vulnerable | Huawei |
| cpe:2.3:h:huawei:ws318n-21:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:huawei:ws318n-21_firmware:10.0.2.2:*:*:*:*:*:*:* Versions 10.0.2.2 Vulnerable ·Huawei
- cpe:2.3:o:huawei:ws318n-21_firmware:10.0.2.5:*:*:*:*:*:*:* Versions 10.0.2.5 Vulnerable ·Huawei
- cpe:2.3:o:huawei:ws318n-21_firmware:10.0.2.6:*:*:*:*:*:*:* Versions 10.0.2.6 Vulnerable ·Huawei
- cpe:2.3:h:huawei:ws318n-21:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-40041
- 2026-10-03 Alias added: GHSA-4frh-rw8g-vq9h
References
Sources
- CVE-2021-40041 · CVE Program
- CVE-2021-40041 · NVD
- FIRST EPSS
- GHSA-4frh-rw8g-vq9h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences