Zero-day vulnerability in Huawei HG532

Command injection
CVE-2017-17215

The vulnerability has been used in Satori attacks against Huawei's router model HG532. The most targeted countries include the United States, Italy, Germany, and Egypt.

Known malware:

Satori botnet, Mirai malware

Vulnerability details

Advisory: SB2017122501 - Remote code execution in Huawei HG532 routers

Vulnerable component: Huawei HG532

CVE-ID: CVE-2017-17215

CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:H/RL:W/RC:C

CWE-ID: CWE-77 - Command injection

Description:

The vulnerability allows a remote attacker with administrator privileges to perform command injection attack on the target system.

The weakness exists due to the implementation of the TR-064 (technical report standard), an application layer protocol for remote management, in the Huawei devices was exposed on the public Internet through Universal Plug and Play (UPnP) protocol at port 37215. A remote attacker can inject shell meta-characters тАЬ$()тАЭ in the NewStatusURL and NewDownloadURL, inject arbitrary commands and execute arbitrary code.

Successful exploitation of the vulnerability allows to download and execute the malicious payload on the Huawei routers and upload Satori botnet that may result in system compromise.

Note: the vulnerability is being actively exploited.

External links:

https://research.checkpoint.com/good-zero-day-skiddie/
http://www.huawei.com/en/psirt/security-notices/huawei-sn-20171130-01-hg532-en
https://thehackernews.com/2017/12/satori-mirai-iot-botnet.html

About zero-day vulnerabilities

Zero-day vulnerability is an undisclosed vulnerability in software that hackers can exploit to compromise computer programs, gain unauthorized access to sensitive data, penetrate networks, etc. We consider vulnerability a zero-day when there is no solution provided from software vendor and the vulnerability is being actively exploited by malicious actors.

Zero-day candidate is a potential zero-day vulnerability in software which might have been used in targeted attacks, however there is no evidence to support this suggestion.