Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability through some operations to inject the C...

CVE-2021-37131 · published 5 years ago
Summary

There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulner...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
huawei manageone 6.5.1
6.5.1.1
8.0.0
8.0.1
cpe:2.3:a:huawei:manageone:6.5.1:rc1.b060:*:*:*:*:*:*
huawei imanager_neteco v600r010c00cp2001
v600r010c00cp2002
v600r010c00cp3001
v600r010c00cp3002
v600r010c00cp3101
v600r010c00cp3102
v600r010c00spc100
v600r010c00spc110
v600r010c00spc120
v600r010c00spc200
v600r010c00spc210
v600r010c00spc300
1 more version range
cpe:2.3:h:huawei:imanager_neteco:v600r010c00cp2001:*:*:*:*:*:*:*
huawei imanager_neteco_6000 v600r009c00cp2201
v600r009c00cp2301
v600r009c00spc100
v600r009c00spc110
v600r009c00spc120
v600r009c00spc190
v600r009c00spc200
v600r009c00spc201
v600r009c00spc202
v600r009c00spc210
v600r009c00spc220
v600r009c00spc221
2 more version ranges
cpe:2.3:h:huawei:imanager_neteco_6000:v600r009c00cp2201:*:*:*:*:*:*:*
Original advisory text
There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability through some operations to inject the C...
There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject CSV files to the target device.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
6.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-1236Improper Neutralization of Formula Elements in a CSV File
Timeline
Published27 Oct 2021
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2021-37131 · NVD
Track software like this
Free during beta