SB2017122501 - Remote code execution in Huawei HG532 routers

Description

This security bulletin contains information about 1 security vulnerability.

1) Command injection (CVE-ID: CVE-2017-17215)

The vulnerability allows a remote attacker with administrator privileges to perform command injection attack on the target system.

The weakness exists due to the implementation of the TR-064 (technical report standard), an application layer protocol for remote management, in the Huawei devices was exposed on the public Internet through Universal Plug and Play (UPnP) protocol at port 37215. A remote attacker can inject shell meta-characters “$()” in the NewStatusURL and NewDownloadURL, inject arbitrary commands and execute arbitrary code.

Successful exploitation of the vulnerability allows to download and execute the malicious payload on the Huawei routers and upload Satori botnet that may result in system compromise.

Note: the vulnerability is being actively exploited.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://research.checkpoint.com/good-zero-day-skiddie/
• http://www.huawei.com/en/psirt/security-notices/huawei-sn-20171130-01-hg532-en