CVE-2017-3216

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
Huawei Technologies	BM2022	2.10.14
Huawei Technologies	HES-309M	unknown
Huawei Technologies	HES-319M	unknown
Huawei Technologies	HES-319M2W	unknown
Huawei Technologies	HES-339M	unknown
Green Packet	OX350	unknown
ZTE	OX-330P	unknown
ZyXEL	MAX218M	2.00(UXG.0)D0
ZyXEL	MAX218M1W	2.00(UXE.3)D0
ZyXEL	MAX218MW	2.00(UXD.2)D0
ZyXEL	MAX308M	2.00(UUA.3)D0
ZyXEL	MAX318M	unknown
ZyXEL	MAX338M	unknown
MADA	Soho Wireless Router	2.10.13

References

http://blog.sec-consult.com/2017/06/ghosts-from-past-authentication-bypass.htmlThird Party Advisory
http://www.kb.cert.org/vuls/id/350135Mitigation, Third Party Advisory, US Government Resource
https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170607-0_Various_WiMAX_CPEs_Authentication_Bypass_v10.txtExploit, Third Party Advisory
http://blog.sec-consult.com/2017/06/ghosts-from-past-authentication-bypass.htmlThird Party Advisory
http://www.kb.cert.org/vuls/id/350135Mitigation, Third Party Advisory, US Government Resource
https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170607-0_Various_WiMAX_CPEs_Authentication_Bypass_v10.txtExploit, Third Party Advisory

Timeline

Published: Jun 20, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-32178.1CalAmp LMU 3030 series OBD-II CDMA and GSM devices has an SMS (text message) interface that can be deployed where no password is configured CVE-2017-32188.8Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP CVE-2017-32198.8Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified us CVE-2017-32219.8Blind SQL injection in Inmarsat AmosConnect 8 login form allows remote attackers to access user credentials, including user names and passwo CVE-2017-32229.8Hard-coded credentials in AmosConnect 8 allow remote attackers to gain full administrative privileges, including the ability to execute comm CVE-2017-32239.8Dahua IP camera products using firmware versions prior to V2.400.0000.14.R.20170713 include a version of the Sonia web interface that may be CVE-2017-32248.2Open Shortest Path First (OSPF) protocol implementations may improperly determine Link State Advertisement (LSA) recency for LSAs with MaxSe CVE-2017-32254.6Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encrypt CVE-2017-32266.4Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. Devices that make use of Das U-Boot's AES-CBC CVE-2017-32308.6Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builder). Supported version CVE-2017-32314.3Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected CVE-2017-32325.5Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools (subcomponent: ASR Manager). The supported version th