High May 13, 2010
Huawei EchoLife HG520c Denial of Service & Unauthorized Factory Reset
Huawei EchoLife HG520c modems expose an unauthenticated factory-reset endpoint and an authenticated remote reboot page, letting an attacker on the LAN or via a malicious website disrupt service and wipe the device configuration.
CVSS Score
7.7 / 10.0
Severity
CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Advisory
| Device | Huawei EchoLife HG520c |
| Firmware | 3.10.18.7-1.0.7.0, 3.10.18.5-1.0.7.0, 3.10.18.4 |
| Software | V100R001B120Telmex, V100R001B121Telmex |
| Websec Advisory | WS10-09 |
Description #1 — Unauthenticated Factory Reset
The page /AutoRestart.html restores the default configuration and reboots the device. It does not require authentication.
Exploit #1
From the LAN (or client-side with the page embedded in a malicious site):
http://192.168.1.254/AutoRestart.htmlIf the remote admin interface is enabled:
https://<router-wan-ip>/AutoRestart.htmlDescription #2 — Authenticated Remote Reboot
The page /rpLocalDeviceJump.html reboots the device when the index query parameter exceeds seven characters. Requires an authenticated session.
Exploit #2
http://192.168.1.254/rpLocalDeviceJump.html?index=HAKIM.WSRemediation
Disable WAN-side HTTP administration. No vendor patch available.