Medium May 13, 2010
Huawei EchoLife HG520 Remote Information Disclosure
Huawei EchoLife HG520 modems are vulnerable to a remote information disclosure vulnerability. This vulnerability can be exploited by sending a specially crafted UDP packet that causes the modems to return sensitive information in clear text form.
CVSS Score
5.3 / 10.0
Severity
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Advisory
| Device | Huawei EchoLife HG520 |
| Firmware | 3.10.18.7-1.0.7.0, 3.10.18.5-1.0.7.0, 3.10.18.4 |
| Software | V100R001B120Telmex, V100R001B121Telmex |
| Websec Advisory | WS10-10 |
Description
A specially crafted UDP packet causes the modem to remotely disclose software and firmware versions, the MAC address, local and remote IP addresses, the device model, and PPPoE credentials in clear text.
Proof of Concept
A working exploit is provided as a Python / Scapy / tcpdump script:
# Local target
python udp520.py
# Remote target
python udp520.py <target-ip>If no response packet is visible, capture with Wireshark. If No module named all is raised, install Scapy from source.
Remediation
Filter inbound UDP traffic to the affected services on the WAN side.