Technical intelligence and weaponization dossier for CVE-2017-17215. Documented exploitation across 1 active malware families totaling 1 analyzed telemetry samples.
| Vulnerability ID | CVE-2017-17215 |
|---|---|
| Common Name / Bulletin | Huawei HG532 Router UPnP Remote Code Execution (Mirai Satori / Okiru) (Huawei Security Advisory) |
| CWE Classification | CWE-78: Command Injection via UPnP SOAP |
| Affected Software & Versions | Huawei HG532 Home Gateway |
| Technical Root Cause | TR-064 / UPnP service on port 37215 permitted arbitrary shell command injection via DeviceConfig:1 SOAP action, weaponized in Mirai botnet expansion. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2017-17215 in enterprise networks:
Inbound TCP connection on port 37215 with HTTP payload containing <NewDownloadURL>`wget -g ...`</NewDownloadURL>.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Botnet Protection & Remediation →