Lucene search

[email protected]CVE-2017-3216

HistoryJun 20, 2017 - 12:29 a.m.

CVE-2017-3216

2017-06-2000:29:00

CWE-306

[email protected]

web.nvd.nist.gov

cve-2017-3216

wimax routers

mediatek sdk

authentication bypass

httpd plugin

remote access

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.1%

JSON

WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request.

Affected configurations

NVD

Node

greenpacketox350_firmwareMatch-

AND

greenpacketox350Match-

Node

huaweibm2022_firmwareMatch-

AND

huaweibm2022Match-

Node

huaweihes-309m_firmwareMatch-

AND

huaweihes-309mMatch-

Node

huaweihes-319m_firmwareMatch-

AND

huaweihes-319mMatch-

Node

huaweihes-319m2w_firmwareMatch-

AND

huaweihes-319m2wMatch-

Node

huaweihes-339m_firmwareMatch-

AND

huaweihes-339mMatch-

Node

madasoho_wireless_router_firmwareMatch-

AND

madasoho_wireless_routerMatch-

Node

zteox-330p_firmwareMatch-

AND

zteox-330pMatch-

Node

zyxelmax218m_firmwareMatch-

AND

zyxelmax218mMatch-

Node

zyxelmax218m1w_firmwareMatch-

AND

zyxelmax218m1wMatch-

Node

zyxelmax218mw_firmwareMatch-

AND

zyxelmax218mwMatch-

Node

zyxelmax308m_fimwareMatch-

AND

zyxelmax308mMatch-

Node

zyxelmax318m_firmwareMatch-

AND

zyxelmax318mMatch-

Node

zyxelmax338m_firmwareMatch-

AND

zyxelmax338mMatch-

CPENameOperatorVersion
greenpacket:ox350_firmwaregreenpacket ox350 firmwareeq-

CPE	Name	Operator	Version
greenpacket:ox350_firmware	greenpacket ox350 firmware	eq	-

CNA Affected

[
  {
    "product": "BM2022",
    "vendor": "Huawei Technologies",
    "versions": [
      {
        "status": "affected",
        "version": "2.10.14"
      }
    ]
  },
  {
    "product": "HES-309M",
    "vendor": "Huawei Technologies",
    "versions": [
      {
        "status": "affected",
        "version": "unknown"
      }
    ]
  },
  {
    "product": "HES-319M",
    "vendor": "Huawei Technologies",
    "versions": [
      {
        "status": "affected",
        "version": "unknown"
      }
    ]
  },
  {
    "product": "HES-319M2W",
    "vendor": "Huawei Technologies",
    "versions": [
      {
        "status": "affected",
        "version": "unknown"
      }
    ]
  },
  {
    "product": "HES-339M",
    "vendor": "Huawei Technologies",
    "versions": [
      {
        "status": "affected",
        "version": "unknown"
      }
    ]
  },
  {
    "product": "OX350",
    "vendor": "Green Packet",
    "versions": [
      {
        "status": "affected",
        "version": "unknown"
      }
    ]
  },
  {
    "product": "OX-330P",
    "vendor": "ZTE",
    "versions": [
      {
        "status": "affected",
        "version": "unknown"
      }
    ]
  },
  {
    "product": "MAX218M",
    "vendor": "ZyXEL",
    "versions": [
      {
        "status": "affected",
        "version": "2.00(UXG.0)D0"
      }
    ]
  },
  {
    "product": "MAX218M1W",
    "vendor": "ZyXEL",
    "versions": [
      {
        "status": "affected",
        "version": "2.00(UXE.3)D0"
      }
    ]
  },
  {
    "product": "MAX218MW",
    "vendor": "ZyXEL",
    "versions": [
      {
        "status": "affected",
        "version": "2.00(UXD.2)D0"
      }
    ]
  },
  {
    "product": "MAX308M",
    "vendor": "ZyXEL",
    "versions": [
      {
        "status": "affected",
        "version": "2.00(UUA.3)D0"
      }
    ]
  },
  {
    "product": "MAX318M",
    "vendor": "ZyXEL",
    "versions": [
      {
        "status": "affected",
        "version": "unknown"
      }
    ]
  },
  {
    "product": "MAX338M",
    "vendor": "ZyXEL",
    "versions": [
      {
        "status": "affected",
        "version": "unknown"
      }
    ]
  },
  {
    "product": "Soho Wireless Router",
    "vendor": "MADA",
    "versions": [
      {
        "status": "affected",
        "version": "2.10.13"
      }
    ]
  }
]

References

blog.sec-consult.com/2017/06/ghosts-from-past-authentication-bypass.html

www.kb.cert.org/vuls/id/350135

sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170607-0_Various_WiMAX_CPEs_Authentication_Bypass_v10.txt

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.1%

JSON

Related for CVE-2017-3216

cert1 cvelist1 nvd1 prion1 myhack581 threatpost1