Unauthenticated access & manipulation of settings in Huawei E5331 MiFi mobile hotspot

SEC Consult Vulnerability Lab Security Advisory < 20140307-0 >


title: Unauthenticated access & manipulation of settings

product: Huawei E5331 MiFi mobile hotspot

vulnerable version: Software version 21.344.11.00.414

fixed version: Software version 21.344.27.00.414

impact: High

homepage: www.huawei.com

found: 2013-12-06

by: J. Greil

SEC Consult Vulnerability Lab




Vendor description:


"Huawei E5331 Mobile WiFi is a high-speed packet access mobile hotspot. It is a

multi-mode wireless terminal for SOHO (Small Office and Home Office) and

business professionals.


You can connect the E5331 with the USB interface of a computer, or connect the

E5331 with the Wi-Fi. In the service area of the HSPA+/HSPA/UMTS/EDGE/GPRS/GSM

network, you can surf the Internet and send/receive messages/emails

cordlessly. The E5331 is fast, reliable, and easy to operate. Thus, mobile

users can experience many new features and services with the E5331. These

features and services will enable a large number of users to use the E5331 and

the average revenue per user (ARPU) of operators will increase substantially."






Business recommendation:


All discovered vulnerabilities can be exploited without authentication and

therefore pose a high security risk.


The scope of the test, where the vulnerabilities have been identified, was a

very short crash-test of the device. It is assumed that further

vulnerabilities exist within this product!


The recommendation of SEC Consult is to perform follow-up security tests of

this device and similar devices.



Vulnerability overview/description:


Unauhenticated attackers are able to gain access to sensitive configuration

(e.g. WLAN passwords in clear text or IMEI information of the SIM card) and

even manipulate all settings in the web administration interface! This also

works when the "Enable firewall" feature is set in "Firewall Switch" settings

of the web interface.


This can even be exploited remotely via Internet depending on the mobile

operator setup. E.g. if the operator allows incoming connections for mobile

networks, the web interface would be accessible and exploitable publicly.


Otherwise those settings can be manipulated via CSRF attacks too. The DNS name

"mobilewifi.home" can be used regardless of the IP address settings.



Proof of concept:


An attacker simply needs to access certain URLs of the web interface in order

to receive the configuration. No authentication is needed!


URL for retrieving wireless passwords / PSK in clear text:

http:// mobilewifi.home/api/wlan/security-settings


XML response:

















Further interesting URLs to retrieve information from (not complete):

http:// mobilewifi.home/api/wlan/wps (WPS pin)

http:// mobilewifi.home/api/security/dmz (DMZ host settings)

http:// mobilewifi.home/api/pin/simlock (enable SIM lock)

http:// mobilewifi.home/api/wlan/host-list (connected wireless clients)

http:// mobilewifi.home/api/device/information (IMEI, MAC, etc)



In order to change settings it is also simply possible to issue POST requests

to the specific URLs. E.g. change the "DMZ Settings" in order to make internal

clients (client IP addresses can be retrieved through the host-list from above)

reachable from the outside:

POST /api/security/dmz HTTP/1.1
Host: mobilewifi.home

<?xml version="1.0"

All those requests can either be issued via CSRF or also from the Internet, if

the web interface of the device is reachable (depends on the mobile operator




Vulnerable / tested versions:


The following version of the device has been tested which was the latest

version available at the time of identification of the flaw (the automatic

update feature did not supply any new version):


Software version: 21.344.11.00.414

Web UI version:



Vendor contact timeline:


2013-12-11: Contacting vendor through psirt@huawei.com

2013-12-12: Reply from vendor

2013-12-18: Vendor requests some further details, sending answer

2014-01-09: Vendor: problem will be resolved in new firmware version

2014-01-14: Patch is planned for 6th March 2014

2014-03-07: SEC Consult releases coordinated security advisory





According to the vendor the following firmware release fixes the identified


* Software version 21.344.27.00.414


It contains the following improvements according to the vendor:

1. Users cannot obtain or set any device parameter without logging in.

2. Added server-side authentication to discard illegitimate packets.



The firmware can be downloaded from here:



The item is called: E5331Update_21.344.27.00.414.B757








Advisory URL:






SEC Consult Vulnerability Lab


SEC Consult

Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius



Mooslackengasse 17, 1190 Vienna, Austria

Phone: +43 1 8903043 0

Fax: +43 1 8903043 15


Mail: research at sec-consult dot com

Web: www.sec-consult.com

Blog: blog.sec-consult.com

Twitter: twitter.com/sec_consult


Interested in working with the experts of SEC Consult?

Write to career@sec-consult.com


EOF J. Greil / @2014