Missing authentication in Huawei BM2022
Priority MEDIUM 50CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-306.
Summary
WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request.
Why it matters now
EPSS 0.05175 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Huawei | BM2022 | 2.10.14 | — | No fix listed | CNA |
| Huawei | HES-309M | unknown | — | No fix listed | CNA |
| Huawei | HES-319M | unknown | — | No fix listed | CNA |
| Huawei | HES-319M2W | unknown | — | No fix listed | CNA |
| Huawei | HES-339M | unknown | — | No fix listed | CNA |
| Green Packet | OX350 | unknown | — | No fix listed | CNA |
| ZTE | OX-330P | unknown | — | No fix listed | CNA |
| Zyxel | MAX218M | 2.00(UXG.0)D0 | — | No fix listed | CNA |
| Zyxel | MAX218M1W | 2.00(UXE.3)D0 | — | No fix listed | CNA |
| Zyxel | MAX218MW | 2.00(UXD.2)D0 | — | No fix listed | CNA |
| Zyxel | MAX308M | 2.00(UUA.3)D0 | — | No fix listed | CNA |
| Zyxel | MAX318M | unknown | — | No fix listed | CNA |
| Zyxel | MAX338M | unknown | — | No fix listed | CNA |
| MADA | Soho Wireless Router | 2.10.13 | — | No fix listed | CNA |
- BM2022 VendorHuawei Affected 2.10.14 Fixed in — No fix listed CNA
- HES-309M VendorHuawei Affected unknown Fixed in — No fix listed CNA
- HES-319M VendorHuawei Affected unknown Fixed in — No fix listed CNA
- HES-319M2W VendorHuawei Affected unknown Fixed in — No fix listed CNA
- HES-339M VendorHuawei Affected unknown Fixed in — No fix listed CNA
- OX350 VendorGreen Packet Affected unknown Fixed in — No fix listed CNA
- OX-330P VendorZTE Affected unknown Fixed in — No fix listed CNA
- MAX218M VendorZyxel Affected 2.00(UXG.0)D0 Fixed in — No fix listed CNA
- MAX218M1W VendorZyxel Affected 2.00(UXE.3)D0 Fixed in — No fix listed CNA
- MAX218MW VendorZyxel Affected 2.00(UXD.2)D0 Fixed in — No fix listed CNA
- MAX308M VendorZyxel Affected 2.00(UUA.3)D0 Fixed in — No fix listed CNA
- MAX318M VendorZyxel Affected unknown Fixed in — No fix listed CNA
- MAX338M VendorZyxel Affected unknown Fixed in — No fix listed CNA
- Soho Wireless Router VendorMADA Affected 2.10.13 Fixed in — No fix listed CNA
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:greenpacket:ox350_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Green Packet |
| cpe:2.3:h:greenpacket:ox350:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Green Packet |
| cpe:2.3:o:huawei:bm2022_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Huawei |
| cpe:2.3:h:huawei:bm2022:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:hes-309m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Huawei |
| cpe:2.3:h:huawei:hes-309m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:hes-319m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Huawei |
| cpe:2.3:h:huawei:hes-319m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:huawei:hes-319m2w_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Huawei |
| cpe:2.3:h:huawei:hes-319m2w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
- cpe:2.3:o:greenpacket:ox350_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Green Packet
- cpe:2.3:h:greenpacket:ox350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Green Packet
- cpe:2.3:o:huawei:bm2022_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Huawei
- cpe:2.3:h:huawei:bm2022:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:hes-309m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Huawei
- cpe:2.3:h:huawei:hes-309m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:hes-319m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Huawei
- cpe:2.3:h:huawei:hes-319m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:huawei:hes-319m2w_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Huawei
- cpe:2.3:h:huawei:hes-319m2w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:huawei:hes-339m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Huawei |
| cpe:2.3:h:huawei:hes-339m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Huawei |
| cpe:2.3:o:mada:soho_wireless_router_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | MADA |
| cpe:2.3:h:mada:soho_wireless_router:-:*:*:*:*:*:*:* | not specified by NVD | Running on | MADA |
| cpe:2.3:o:zte:ox-330p_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | ZTE |
| cpe:2.3:h:zte:ox-330p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ZTE |
| cpe:2.3:o:zyxel:max218m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:max218m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:max218m1w_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:max218m1w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:max218mw_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:max218mw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:max308m_fimware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:max308m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:max318m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:max318m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
| cpe:2.3:o:zyxel:max338m_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Zyxel |
| cpe:2.3:h:zyxel:max338m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Zyxel |
- cpe:2.3:o:huawei:hes-339m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Huawei
- cpe:2.3:h:huawei:hes-339m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Huawei
- cpe:2.3:o:mada:soho_wireless_router_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MADA
- cpe:2.3:h:mada:soho_wireless_router:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·MADA
- cpe:2.3:o:zte:ox-330p_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·ZTE
- cpe:2.3:h:zte:ox-330p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ZTE
- cpe:2.3:o:zyxel:max218m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:max218m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:max218m1w_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:max218m1w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:max218mw_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:max218mw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:max308m_fimware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:max308m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:max318m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:max318m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
- cpe:2.3:o:zyxel:max338m_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Zyxel
- cpe:2.3:h:zyxel:max338m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zyxel
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-3216
- 2026-10-03 Alias added: GHSA-mf99-f92w-2rq5
References
Sources
- CVE-2017-3216 · CVE Program
- CVE-2017-3216 · NVD
- FIRST EPSS
- GHSA-mf99-f92w-2rq5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences