{"id":"CVE-2017-17215","published":"2018-03-20T15:00:00Z","modified":"2024-08-05T20:43:59Z","title":"Huawei HG532 with some customized versions has a remote code execution vulnerability","vendor":"Huawei Technologies Co., Ltd.","product":"HG532","tier":"core","eol":null,"affectedVersions":[{"vendor":"Huawei Technologies Co., Ltd.","product":"HG532","versions":["customized versions"]}],"description":{"text":"Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send malicious packets to port 37215 to launch attacks. Successful exploit could lead to the remote execution of arbitrary code.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Huawei HG532 router, in certain customized firmware versions, contains a remote code execution flaw that lives in the device's network-facing service handling traffic on port 37215. An attacker who is already authenticated can send crafted packets to that port to run arbitrary code on the device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:37Z"},"cvss":null,"epss":{"score":0.78278,"percentile":0.99579,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2017-12-21","exploitedFirstSeen":"2017-12-21","ransomware":false,"evidence":[{"url":"https://research.checkpoint.com/2017/good-zero-day-skiddie/","date":"2017-12-21"},{"url":"https://threatpost.com/huawei-router-vulnerability-used-to-spread-mirai-variant/129238/","date":"2017-12-22"},{"url":"https://blog.netlab.360.com/art-of-steal-satori-variant-is-robbing-eth-bitcoin-by-replacing-wallet-address-en/","date":"2018-01-17"},{"url":"https://www.netscout.com/blog/asert/arc-satori","date":"2018-01-18"},{"url":"https://blog.newskysecurity.com/masuta-satori-creators-second-botnet-weaponizes-a-new-router-exploit-2ddc51cc52a7","date":"2018-01-23"},{"url":"https://unit42.paloaltonetworks.com/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/","date":"2018-07-20"},{"url":"https://blog.lumen.com/the-resilient-satori-botnet/","date":"2018-10-27"},{"url":"https://unit42.paloaltonetworks.com/mirai-compiled-for-new-processor-surfaces/","date":"2019-04-08"},{"url":"https://www.trendmicro.com/en_us/research/19/e/new-mirai-variant-uses-multiple-exploits-to-target-routers-and-other-devices.html","date":"2019-05-23"},{"url":"https://blog.netlab.360.com/mozi-another-botnet-using-dht/","date":"2019-12-23"}],"evidenceTotal":1135,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"TinyNote | Douglas County, Co Sheriff's Office | Pegasus Attacks SA victim ( Credit OctoSeek)","url":"https://otx.alienvault.com/pulse/6acbda09ee093f3881daa2a9","created":"2026-10-11"},{"name":"Kraddare • Agent Tesla (Credit OctoSeek)","url":"https://otx.alienvault.com/pulse/6ab7c8fee6aeb0b066e21b0e","created":"2026-09-26"},{"name":"clone credit ravenscoutllc. Title dragonforce.io | other healthcare ddos","url":"https://otx.alienvault.com/pulse/6aad27a4f50e969a9399b4a2","created":"2026-09-18"},{"name":"credit octoseek/3yrs ago Darkside 2020 Ecosystem .BEware | BGP.tools | Target T..cl-one","url":"https://otx.alienvault.com/pulse/6aa8d07dd09b074cfef8b8bd","created":"2026-09-15"},{"name":"Canary Tokens | Part-RU | My AlienVault Acount |","url":"https://otx.alienvault.com/pulse/6a8694c7da5686783c553d7e","created":"2026-08-20"},{"name":"Canary Tokens | Part-RU | My AlienVault Acount |","url":"https://otx.alienvault.com/pulse/6a8694970bf358e3393b7189","created":"2026-08-20"},{"name":"credit scoreblue | 3 years ago | BGP.Tools - clone","url":"https://otx.alienvault.com/pulse/6a7e845fdc20e345610b1373","created":"2026-08-14"},{"name":"credit scoreblue | 3 years ago | BGP.Tools - clone","url":"https://otx.alienvault.com/pulse/6a7e845e33212f5e99513063","created":"2026-08-14"},{"name":"Jan, 2025 clone credit aclause21 | \"order\"","url":"https://otx.alienvault.com/pulse/6a6ed70258d6cf280398aa19","created":"2026-08-02"},{"name":"Jan, 2025 clone credit aclause21 | \"order\"","url":"https://otx.alienvault.com/pulse/6a6ed701a1f69f865c026c90","created":"2026-08-02"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/102344","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.huawei.com/en/psirt/security-notices/huawei-sn-20171130-01-hg532-en","tags":["x_refsource_CONFIRM"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Network exploitation of exposed service port","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"could send malicious packets to port 37215","start":112,"end":154}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Successful exploit yields arbitrary code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"could lead to the remote execution of arbitrary code","start":193,"end":245}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-ab60e18dfb72c1e085c0","title":"Matrix Unleashes A New Widespread DDoS Campaign","publisher":"aquasec.com","url":"https://www.aquasec.com/blog/matrix-unleashes-a-new-widespread-ddos-campaign/","date":"2024-11-26","mentions":[{"quote":"However, the majority of the vulnerabilities center around IoT devices (CVE-2022-30525, CVE-2022-30075, CVE-2018-10562, CVE-2018-10561, CVE-2018-9995, CVE-2017-18368, CVE-2017-17215, CVE-2017-17106, and CVE-2014-8361).","start":7138,"end":7356},{"quote":"CVE-2017-17215: A remote code execution vulnerability affecting certain Huawei routers.","start":31061,"end":31148}]},{"id":"SRC-b3ea000916d84bc1c41a","title":"Microsoft research uncovers new Zerobot capabilities","publisher":"microsoft.com","url":"http://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/","date":null,"mentions":[{"quote":"CVE-2017-17215","start":12001,"end":12015}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-8381","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-8381","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":43414,"url":"https://www.exploit-db.com/exploits/43414","title":"Huawei Router HG532 - Arbitrary Command Execution","type":"webapps","platform":"hardware","date":"2017-12-25","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2017-12-25"},"pocGithub":{"count":4,"skipped":0,"earliest":"2017-12-25","earliestUrl":"https://github.com/1337g/CVE-2017-17215","repos":[{"name":"1337g/CVE-2017-17215","url":"https://github.com/1337g/CVE-2017-17215","stars":26,"created":"2017-12-25"},{"name":"wilfred-wulbou/HG532d-RCE-Exploit","url":"https://github.com/wilfred-wulbou/HG532d-RCE-Exploit","stars":9,"created":"2020-11-17"},{"name":"ltfafei/HuaWei_Route_HG532_RCE_CVE-2017-17215","url":"https://github.com/ltfafei/HuaWei_Route_HG532_RCE_CVE-2017-17215","stars":0,"created":"2022-11-02"},{"name":"luel-4013/misfortune-cookie","url":"https://github.com/luel-4013/misfortune-cookie","stars":0,"created":"2026-09-07"}]},"first":{"date":"2017-12-25","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/43414"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2017-12-21","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://research.checkpoint.com/2017/good-zero-day-skiddie/","provenance":"source"},{"date":"2017-12-25","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-43414); later: PoC-in-GitHub 2017-12-25","url":"https://www.exploit-db.com/exploits/43414","provenance":"source"},{"date":"2018-03-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2017-17215","provenance":"source"},{"date":"2024-11-26","kind":"report","label":"Named in aquasec.com: Matrix Unleashes A New Widespread DDoS Campaign","url":"https://www.aquasec.com/blog/matrix-unleashes-a-new-widespread-ddos-campaign/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":69.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3236 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9958"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 4 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}