Loading vulnerability…
Remote Command Injection in Huawei HG532 DeviceUpgrade Service
CVE-2017-17215 is an OS command-injection vulnerability affecting certain customized versions of Huawei HG532 router firmware. The router exposes a TR-064 management implementation through UPnP on WAN-accessible TCP port 37215, despite TR-064 being intended for local-network configuration. The DeviceUpgrade service permits shell metacharacters in the NewStatusURL and NewDownloadURL parameters to trigger arbitrary command execution. An authenticated remote attacker can submit a crafted HTTP/XML request to execute code on the router. The vulnerability has been widely exploited to distribute Satori and other Mirai-derived botnet malware.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises router integrity by allowing arbitrary commands and malware execution. Observed attacks download and execute botnet payloads that place compromised routers under remote control and generate TCP or UDP floods. Compromised devices can also be used to scan for and infect additional vulnerable systems.
If you can’t patch tonight, do this now.
Block untrusted access to TCP port 37215 using the router's built-in firewall or a carrier-side firewall. Disable unnecessary WAN-facing management services and restrict required management access to trusted networks. Replace default administrative passwords with strong, unique credentials. Segment affected routers and IoT devices to limit the consequences of compromise, and monitor for exploitation attempts and unexpected outbound scanning.
Patch, then assume compromise.
Apply Huawei or the service provider's firmware update addressing CVE-2017-17215 for the specific HG532 customization. A fixed firmware version is not established here. Replace or decommission affected devices if supported, corrected firmware is unavailable.
2 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
83 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.