Remote code execution in Huawei HG532 routers

Published: 2017-12-25 | Updated: 2017-12-25
Severity Critical
Patch available NO
Number of vulnerabilities 1
CVE ID CVE-2017-17215
CWE ID CWE-77
Exploitation vector Network
Public exploit This vulnerability is being exploited in the wild.
Vulnerable software Huawei HG532 Subscribe
Vendor Huawei

Security Advisory

This security advisory describes one critical risk vulnerability.

1) Command injection

Severity: Critical

CVSSv3: 8.9 [CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:H/RL:W/RC:C] [PCI]

CVE-ID: CVE-2017-17215

CWE-ID: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Description

The vulnerability allows a remote attacker with administrator privileges to perform command injection attack on the target system.

The weakness exists due to the implementation of the TR-064 (technical report standard), an application layer protocol for remote management, in the Huawei devices was exposed on the public Internet through Universal Plug and Play (UPnP) protocol at port 37215. A remote attacker can inject shell meta-characters “$()” in the NewStatusURL and NewDownloadURL, inject arbitrary commands and execute arbitrary code.

Successful exploitation of the vulnerability allows to download and execute the malicious payload on the Huawei routers and upload Satori botnet that may result in system compromise.

Note: the vulnerability is being actively exploited.

Mitigation

Customers can take the following measures to circumvent or prevent the exploit of this vulnerability. For details, consult the local service provider or Huawei TAC.

(1)     Configure the built-in firewall function.

(2)     Change the default password.

(3)     Deploy a firewall at the carrier side.

The customers can deploy Huawei NGFWs (Next Generation Firewall) or data center firewalls, and upgrade the IPS signature database to the latest version IPS_H20011000_2017120100 released on December 1, 2017 to detect and defend against this vulnerability exploits initiated from the Internet.

Vulnerable software versions

Huawei HG532: -

CPE External links

https://research.checkpoint.com/good-zero-day-skiddie/
http://www.huawei.com/en/psirt/security-notices/huawei-sn-20171130-01-hg532-en

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.