Critical June 14, 2012
Huawei HG866 authentication bypass
The web management interface of Huawei HG688 routers has several pages which fail to validate the user's session. This allows an attacker to bypass the authentication both locally and remotely.
CVSS Score
9.8 / 10.0
Severity
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Advisory
| Device | Huawei EchoLife HG866 |
| Hardware | HG866GTA_VER.C, 01, 02 |
| Software | V1R2C01SPC202, R3.2.4.92sbn - R3.4.2.257sbn, 3FE53864AOCB16 |
| Impact | Remote authentication bypass with full admin takeover |
| Attack Vector | Remote |
Description
The Huawei HG866 is a GPON ONT with a web management interface (4FE + 2 POTS + Wi-Fi + 2 USB). Several pages in the administrative interface fail to validate the user's session, allowing the authentication layer to be bypassed locally and remotely.
Because session validation is absent, an attacker can change the administrator password by issuing a POST request to /html/password.html, without supplying any credentials.
Remediation
No vendor fix. Disable WAN-side HTTP administration.