CVE-2017-3216
Critical
Description
WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Greenpacket Ox350 Firmware
PublishedJun 20, 2017
First seenJun 20, 2017
Weakness typeCWE-306Missing authentication for critical function
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| greenpacket ox350_firmware | No range specified | — |
| huawei bm2022_firmware | No range specified | — |
| huawei hes-309m_firmware | No range specified | — |
| huawei hes-319m_firmware | No range specified | — |
| huawei hes-319m2w_firmware | No range specified | — |
| huawei hes-339m_firmware | No range specified | — |
| mada soho_wireless_router_firmware | No range specified | — |
| zte ox-330p_firmware | No range specified | — |
| zyxel max218m_firmware | No range specified | — |
| zyxel max218m1w_firmware | No range specified | — |
| zyxel max218mw_firmware | No range specified | — |
| zyxel max308m_fimware | No range specified | — |
| zyxel max318m_firmware | No range specified | — |
| zyxel max338m_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.