CVE-2017-3216
WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to...
CVE-2017-3216 is a critical vulnerability (CVSS 9.8) in Green Packet Ox350, published June 20, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.17%, the 92nd percentile. No source names a fixed version.
- Severity
- 9.8 CriticalCVSS 3.0, NVD
- Exploit chance
- 5.17%EPSS, 92nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
- green packet ox350
- greenpacket ox350 firmware
- huawei bm2022 firmware
- huawei hes-309m firmware
- huawei hes-319m2w firmware
- huawei hes-319m firmware
- huawei hes-339m firmware
- huawei technologies bm2022
- huawei technologies hes-309m
- huawei technologies hes-319m
- huawei technologies hes-319m2w
- huawei technologies hes-339m
Show 16 moreShow less
- mada soho wireless router
- mada soho wireless router firmware
- zte ox-330p
- zte ox-330p firmware
- zyxel max218m
- zyxel max218m1w
- zyxel max218m1w firmware
- zyxel max218m firmware
- zyxel max218mw
- zyxel max218mw firmware
- zyxel max308m
- zyxel max308m fimware
- zyxel max318m
- zyxel max318m firmware
- zyxel max338m
- zyxel max338m firmware
What each source reports
NVD Score used
WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request.
- Record
CVE-2017-3216- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-306
- Updated
- 2026-11-02
CVE ListNo score
WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request.
- Record
CVE-2017-3216- Weakness
- CWE-306
- Updated
- 2026-11-02
EUVDEUVD-2017-12337No score
WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request.
- Record
EUVD-2017-12337- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mf99-f92w-2rq5
WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to...
WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request.
- Record
GHSA-mf99-f92w-2rq5- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-306
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.