CVE-2017-3216 — WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request

Back Back to CVE browser

CRITICAL

WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request

Published Jun 20, 2017

9.8

CRITICAL

CVSS 3.0

EPSS 5.17%

Description

WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change on the device via a crafted POST request.

Affected products

Vendor Green Packet Product n/a Default
n/a
- Version
  unknown
  Status
  affected
  Constraints
  -
Vendor Huawei Technologies Product HES-309M Default
n/a
- Version
  unknown
  Status
  affected
  Constraints
  -
Vendor Huawei Technologies Product HES-319M Default
n/a
- Version
  unknown
  Status
  affected
  Constraints
  -
Vendor Huawei Technologies Product Hes-319m2w Default
n/a
- Version
  unknown
  Status
  affected
  Constraints
  -
Vendor Huawei Technologies Product HES-339M Default
n/a
- Version
  unknown
  Status
  affected
  Constraints
  -
Vendor Huawei Technologies Product n/a Default
n/a
- Version
  2.10.14
  Status
  affected
  Constraints
  -
Vendor MADA Product Soho Wireless Router Default
n/a
- Version
  2.10.13
  Status
  affected
  Constraints
  -
Vendor ZTE Product OX-330P Default
n/a
- Version
  unknown
  Status
  affected
  Constraints
  -
Vendor Zyxel Product MAX218M Default
n/a
- Version
  2.00(UXG.0)D0
  Status
  affected
  Constraints
  -
Vendor Zyxel Product Max218m1w Default
n/a
- Version
  2.00(UXE.3)D0
  Status
  affected
  Constraints
  -
Vendor Zyxel Product Max218mw Default
n/a
- Version
  2.00(UXD.2)D0
  Status
  affected
  Constraints
  -
Vendor Zyxel Product MAX308M Default
n/a
- Version
  2.00(UUA.3)D0
  Status
  affected
  Constraints
  -
Vendor Zyxel Product MAX318M Default
n/a
- Version
  unknown
  Status
  affected
  Constraints
  -
Vendor Zyxel Product MAX338M Default
n/a
- Version
  unknown
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Green Packet

n/a

Version	Status	Constraints
unknown	affected	-

Huawei Technologies

HES-309M

n/a

Version	Status	Constraints
unknown	affected	-

Huawei Technologies

HES-319M

n/a

Version	Status	Constraints
unknown	affected	-

Huawei Technologies

Hes-319m2w

n/a

Version	Status	Constraints
unknown	affected	-

Huawei Technologies

HES-339M

n/a

Version	Status	Constraints
unknown	affected	-

Huawei Technologies

n/a

Version	Status	Constraints
2.10.14	affected	-

MADA

Soho Wireless Router

n/a

Version	Status	Constraints
2.10.13	affected	-

ZTE

OX-330P

n/a

Version	Status	Constraints
unknown	affected	-

Zyxel

MAX218M

n/a

Version	Status	Constraints
2.00(UXG.0)D0	affected	-

Zyxel

Max218m1w

n/a

Version	Status	Constraints
2.00(UXE.3)D0	affected	-

Zyxel

Max218mw

n/a

Version	Status	Constraints
2.00(UXD.2)D0	affected	-

Zyxel

MAX308M

n/a

Version	Status	Constraints
2.00(UUA.3)D0	affected	-

Zyxel

MAX318M

n/a

Version	Status	Constraints
unknown	affected	-

Zyxel

MAX338M

n/a

Version	Status	Constraints
unknown	affected	-

Remediation

No remediation recorded yet.

Metrics

5.17% 0.05175

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.05175

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (14 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	5.17% (0.05175)	92.19th	v5 (v2026.06.15)
Jun 15, 2026	5.17% (0.05175)	91.35th	v5 (v2026.06.15)
Mar 17, 2025	4.16% (0.04162)	87.91th	v4 (v2025.03.14)
Jul 20, 2024	0.75% (0.00754)	81.24th	v3 (v2023.03.01)
Feb 8, 2024	0.75% (0.00754)	80.44th	v3 (v2023.03.01)
Mar 7, 2023	0.75% (0.00754)	78.14th	v3 (v2023.03.01)
Mar 6, 2023	1.14% (0.01136)	59.45th	v2 (v2022.01.01)
Oct 18, 2022	1.14% (0.01136)	58.28th	v2 (v2022.01.01)
Apr 1, 2022	1.14% (0.01136)	56.27th	v2 (v2022.01.01)
Feb 4, 2022	1.14% (0.01136)	34.23th	v2 (v2022.01.01)
Feb 3, 2022	1.05% (0.01046)	28.66th	v1
Jan 6, 2022	1.05% (0.01046)	28.03th	v1
Sep 1, 2021	1.05% (0.01046)	65.02th	v1
Apr 14, 2021	1.05% (0.01046)	0.00th	v1

Weaknesses (1)

CWE-306

Missing Authentication

References (3)

http://blog.sec-consult.com/2017/06/ghosts-from-past-authentication-bypass.html
x_refsource_MISCThird Party Advisory
http://www.kb.cert.org/vuls/id/350135
third-party-advisoryx_refsource_CERT-VNMitigationThird Party AdvisoryUS Government Resource
https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170607-0_Various_WiMAX_CPEs_Authentication_Bypass_v10.txt
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
http://blog.sec-consult.com/2017/06/ghosts-from-past-authentication-bypass.html		x_refsource_MISCThird Party Advisory
http://www.kb.cert.org/vuls/id/350135		third-party-advisoryx_refsource_CERT-VNMitigationThird Party AdvisoryUS Government Resource
https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170607-0_Various_WiMAX_CPEs_Authentication_Bypass_v10.txt		x_refsource_MISCExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner certcc

Published Jun 20, 2017

Updated Aug 5, 2024

Reserved Dec 5, 2016

Link CVE-2017-3216

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2017-3216

Red Hat

Severity n/a

Public date n/a

Links CVE-2017-3216