JVN#41646618: Huawei EchoLife HG8045Q vulnerable to OS command injection

EchoLife HT8045Q provided by Huawei is an ONT (Optical Network Terminal) device.
It is equipped with the command line interface for network operators’ maintenance purpose, which is disabled by default.
When the command line interface is enabled, operators can interact with a certain restricted set of commands.
The command-line interface fails to process properly a certain crafted inputs, which enables some BusyBox-implemented commands executed (CWE-78).

Impact

When the command line interface is enabled, an administrator user may execute a certain set of OS commands on the device.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer. The developer has released the following version that addresses the vulnerability.

• Software version: V300R016C00SPC130 (for V300R016C00SPC110)
• Software version: R18C10SPC152 (for V300R018C10)

Products Affected

• Hardware model: HG8045Q
  • Software version: V300R016C00SPC110
  • Software version: V300R018C10