There is a deserialization vulnerability in Huawei AnyOffice V200R006C10. An attacker can construct a specific request to exploit this vulnerability. Successfully exploiting this vulnerability, the attacker can execute remote malicious code injection and to control the device.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-22439
• https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210619-01-injection-en