{"id":"CVE-2017-3216","state":"PUBLISHED","title":"WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain admin","description":"WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request.","publishedAt":"2017-06-20T00:00:00.000Z","updatedAt":"2024-08-05T14:16:28.271Z","severity":null,"assigner":"certcc","products":["Huawei Technologies BM2022","Huawei Technologies HES-309M","Huawei Technologies HES-319M","Huawei Technologies HES-319M2W","Huawei Technologies HES-339M","Green Packet OX350","ZTE OX-330P","ZyXEL MAX218M","ZyXEL MAX218M1W","ZyXEL MAX218MW","ZyXEL MAX308M","ZyXEL MAX318M","ZyXEL MAX338M","MADA Soho Wireless Router"],"affected":[{"vendor":"Huawei Technologies","product":"BM2022","versions":[{"version":"2.10.14","status":"affected"}]},{"vendor":"Huawei Technologies","product":"HES-309M","versions":[{"version":"unknown","status":"affected"}]},{"vendor":"Huawei Technologies","product":"HES-319M","versions":[{"version":"unknown","status":"affected"}]},{"vendor":"Huawei Technologies","product":"HES-319M2W","versions":[{"version":"unknown","status":"affected"}]},{"vendor":"Huawei Technologies","product":"HES-339M","versions":[{"version":"unknown","status":"affected"}]},{"vendor":"Green Packet","product":"OX350","versions":[{"version":"unknown","status":"affected"}]},{"vendor":"ZTE","product":"OX-330P","versions":[{"version":"unknown","status":"affected"}]},{"vendor":"ZyXEL","product":"MAX218M","versions":[{"version":"2.00(UXG.0)D0","status":"affected"}]},{"vendor":"ZyXEL","product":"MAX218M1W","versions":[{"version":"2.00(UXE.3)D0","status":"affected"}]},{"vendor":"ZyXEL","product":"MAX218MW","versions":[{"version":"2.00(UXD.2)D0","status":"affected"}]},{"vendor":"ZyXEL","product":"MAX308M","versions":[{"version":"2.00(UUA.3)D0","status":"affected"}]},{"vendor":"ZyXEL","product":"MAX318M","versions":[{"version":"unknown","status":"affected"}]},{"vendor":"ZyXEL","product":"MAX338M","versions":[{"version":"unknown","status":"affected"}]},{"vendor":"MADA","product":"Soho Wireless Router","versions":[{"version":"2.10.13","status":"affected"}]}],"references":["http://blog.sec-consult.com/2017/06/ghosts-from-past-authentication-bypass.html","https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170607-0_Various_WiMAX_CPEs_Authentication_Bypass_v10.txt","http://www.kb.cert.org/vuls/id/350135"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T19:43:42.704Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2017/3xxx/CVE-2017-3216.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2017-3216","state":"PUBLISHED","datePublished":"2017-06-20T00:00:00.000Z","dateUpdated":"2024-08-05T14:16:28.271Z","assignerShortName":"certcc","assignerOrgId":"37e5125f-f79b-445b-8fad-9564f167944b","dateReserved":"2016-12-05T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request."}],"affected":[{"vendor":"Huawei Technologies","product":"BM2022","versions":[{"version":"2.10.14","status":"affected"}]},{"vendor":"Huawei Technologies","product":"HES-309M","versions":[{"version":"unknown","status":"affected"}]},{"vendor":"Huawei Technologies","product":"HES-319M","versions":[{"version":"unknown","status":"affected"}]},{"vendor":"Huawei Technologies","product":"HES-319M2W","versions":[{"version":"unknown","status":"affected"}]},{"vendor":"Huawei Technologies","product":"HES-339M","versions":[{"version":"unknown","status":"affected"}]},{"vendor":"Green Packet","product":"OX350","versions":[{"version":"unknown","status":"affected"}]},{"vendor":"ZTE","product":"OX-330P","versions":[{"version":"unknown","status":"affected"}]},{"vendor":"ZyXEL","product":"MAX218M","versions":[{"version":"2.00(UXG.0)D0","status":"affected"}]},{"vendor":"ZyXEL","product":"MAX218M1W","versions":[{"version":"2.00(UXE.3)D0","status":"affected"}]},{"vendor":"ZyXEL","product":"MAX218MW","versions":[{"version":"2.00(UXD.2)D0","status":"affected"}]},{"vendor":"ZyXEL","product":"MAX308M","versions":[{"version":"2.00(UUA.3)D0","status":"affected"}]},{"vendor":"ZyXEL","product":"MAX318M","versions":[{"version":"unknown","status":"affected"}]},{"vendor":"ZyXEL","product":"MAX338M","versions":[{"version":"unknown","status":"affected"}]},{"vendor":"MADA","product":"Soho Wireless Router","versions":[{"version":"2.10.13","status":"affected"}]}],"references":[{"url":"http://blog.sec-consult.com/2017/06/ghosts-from-past-authentication-bypass.html","tags":["x_refsource_MISC"]},{"url":"https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170607-0_Various_WiMAX_CPEs_Authentication_Bypass_v10.txt","tags":["x_refsource_MISC"]},{"url":"http://www.kb.cert.org/vuls/id/350135","name":"VU#350135","tags":["third-party-advisory","x_refsource_CERT-VN"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"certcc","dateUpdated":"2017-06-19T23:57:01.000Z","orgId":"37e5125f-f79b-445b-8fad-9564f167944b"},"datePublic":"2017-06-07T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cert@cert.org","ID":"CVE-2017-3216","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"BM2022","version":{"version_data":[{"version_value":"2.10.14"}]}},{"product_name":"HES-309M","version":{"version_data":[{"version_value":"unknown"}]}},{"product_name":"HES-319M","version":{"version_data":[{"version_value":"unknown"}]}},{"product_name":"HES-319M2W","version":{"version_data":[{"version_value":"unknown"}]}},{"product_name":"HES-339M","version":{"version_data":[{"version_value":"unknown"}]}}]},"vendor_name":"Huawei Technologies"},{"product":{"product_data":[{"product_name":"OX350","version":{"version_data":[{"version_value":"unknown"}]}}]},"vendor_name":"Green Packet"},{"product":{"product_data":[{"product_name":"OX-330P","version":{"version_data":[{"version_value":"unknown"}]}}]},"vendor_name":"ZTE"},{"product":{"product_data":[{"product_name":"MAX218M","version":{"version_data":[{"version_value":"2.00(UXG.0)D0"}]}},{"product_name":"MAX218M1W","version":{"version_data":[{"version_value":"2.00(UXE.3)D0"}]}},{"product_name":"MAX218MW","version":{"version_data":[{"version_value":"2.00(UXD.2)D0"}]}},{"product_name":"MAX308M","version":{"version_data":[{"version_value":"2.00(UUA.3)D0"}]}},{"product_name":"MAX318M","version":{"version_data":[{"version_value":"unknown"}]}},{"product_name":"MAX338M","version":{"version_data":[{"version_value":"unknown"}]}}]},"vendor_name":"ZyXEL"},{"product":{"product_data":[{"product_name":"Soho Wireless Router","version":{"version_data":[{"version_value":"2.10.13"}]}}]},"vendor_name":"MADA"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-306"}]}]},"references":{"reference_data":[{"name":"http://blog.sec-consult.com/2017/06/ghosts-from-past-authentication-bypass.html","refsource":"MISC","url":"http://blog.sec-consult.com/2017/06/ghosts-from-past-authentication-bypass.html"},{"name":"https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170607-0_Various_WiMAX_CPEs_Authentication_Bypass_v10.txt","refsource":"MISC","url":"https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170607-0_Various_WiMAX_CPEs_Authentication_Bypass_v10.txt"},{"name":"VU#350135","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/350135"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://blog.sec-consult.com/2017/06/ghosts-from-past-authentication-bypass.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170607-0_Various_WiMAX_CPEs_Authentication_Bypass_v10.txt","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.kb.cert.org/vuls/id/350135","name":"VU#350135","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-05T14:16:28.271Z"}}]}}}