Quantum Secular Labs / Blog / Advisories

CVE-2017-3216: WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an…

CVE-2017-3216 is rated critical with a CVSS v3.0 base score of 9.8 and NVD lists 14 affected products, including Greenpacket Ox350 Firmware. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request.

Severity breakdown

CVSS v3.0 9.8: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Unchanged. Impact stays within the vulnerable component.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Underlying weakness

CWE-306: Missing Authentication for Critical Functionality

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Affected products

  • Greenpacket Ox350 Firmware: all versions listed by NVD
  • Huawei Bm2022 Firmware: all versions listed by NVD
  • Huawei Hes 309m Firmware: all versions listed by NVD
  • Huawei Hes 319m Firmware: all versions listed by NVD
  • Huawei Hes 319m2w Firmware: all versions listed by NVD
  • Huawei Hes 339m Firmware: all versions listed by NVD
  • Mada Soho Wireless Router Firmware: all versions listed by NVD
  • ZTE Ox 330p Firmware: all versions listed by NVD
  • Zyxel Max218m Firmware: all versions listed by NVD
  • Zyxel Max218m1w Firmware: all versions listed by NVD
  • Zyxel Max218mw Firmware: all versions listed by NVD
  • Zyxel Max308m Fimware: all versions listed by NVD
  • Zyxel Max318m Firmware: all versions listed by NVD
  • Zyxel Max338m Firmware: all versions listed by NVD

References