CVE-2017-3216 WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to t...
CriticalCVSS 9.8
EPSS 5.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| greenpacket ox350 firmware | All versions | No fix listed |
| Huawei bm2022 firmware | All versions | No fix listed |
| Huawei hes-309m firmware | All versions | No fix listed |
| Huawei hes-319m firmware | All versions | No fix listed |
| Huawei hes-319m2w firmware | All versions | No fix listed |
| Huawei hes-339m firmware | All versions | No fix listed |
| mada soho wireless router firmware | All versions | No fix listed |
| ZTE ox-330p firmware | All versions | No fix listed |
| zyxel max218m firmware | All versions | No fix listed |
| zyxel max218m1w firmware | All versions | No fix listed |
| zyxel max218mw firmware | All versions | No fix listed |
| zyxel max308m fimware | All versions | No fix listed |
| zyxel max318m firmware | All versions | No fix listed |
| zyxel max338m firmware | All versions | No fix listed |
| Huawei Technologies Co., Ltd. BM2022 | = 2.10.14 | No fix listed |
| Huawei Technologies Co., Ltd. HES-309M | All versions | No fix listed |
| Huawei Technologies Co., Ltd. HES-319M | All versions | No fix listed |
| Huawei Technologies Co., Ltd. HES-319M2W | All versions | No fix listed |
| Huawei Technologies Co., Ltd. HES-339M | All versions | No fix listed |
| Green Packet OX350 | All versions | No fix listed |
| ZTE OX-330P | All versions | No fix listed |
| zyxel MAX218M | = 2.00(UXG.0)D0 | No fix listed |
| zyxel MAX218M1W | = 2.00(UXE.3)D0 | No fix listed |
| zyxel MAX218MW | = 2.00(UXD.2)D0 | No fix listed |
| zyxel MAX308M | = 2.00(UUA.3)D0 | No fix listed |
Show 3 more
| Product | Affected versions | Fixed in |
|---|---|---|
| zyxel MAX318M | All versions | No fix listed |
| zyxel MAX338M | All versions | No fix listed |
| mada Soho Wireless Router | = 2.10.13 | No fix listed |
References
- blog.sec-consult.com third-party-advisory
- VU#350135 mitigation third-party-advisory us-government-resource
- sec-consult.com exploit third-party-advisory