CVE-2017-17215
HIGH EXPLOITED IN THE WILDHuawei HG532 Firmware - Authenticated Remote Code Execution via Port 37215
Title source: llmExploitation Summary
CVE-2017-17215 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 4 public exploits from researchers including anonymous, 1337g, wilfred-wulbou.
AI-analyzed exploit summary This exploit targets CVE-2027-17215, a command injection vulnerability in Huawei HG532 routers. It sends a malicious SOAP request to the DeviceUpgrade_1 endpoint, allowing arbitrary command execution via the NewStatusURL field.
Description
Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send malicious packets to port 37215 to launch attacks. Successful exploit could lead to the remote execution of arbitrary code.
Exploits (4)
This exploit targets CVE-2027-17215, a command injection vulnerability in Huawei HG532 routers. It sends a malicious SOAP request to the DeviceUpgrade_1 endpoint, allowing arbitrary command execution via the NewStatusURL field.
This repository contains a README describing CVE-2017-17215, a vulnerability in Huawei routers, but does not include actual exploit code. The author mentions the exploit was already public and references a blog post about its use in botnets.
This is a functional RCE exploit for CVE-2017-17215 targeting Huawei HG532d routers. It leverages a UPnP vulnerability via a crafted SOAP request to execute arbitrary commands, bypassing input sanitization.
This repository provides a writeup and screenshots for CVE-2017-17215, a command injection vulnerability in Huawei HG532 routers. It references external implementations in Go and POCsuite but does not contain actual exploit code.
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H