CVE-2017-17215

Think of the router as the “gatekeeper” between your business and the internet. This flaw can let a person who already has login access (and can reach a specific network port) send special traffic to the router that causes it to run attacker-controlled code—like giving someone the keys and then tricking the gatekeeper into opening the doors in the attacker’s way.

This matters if you use or manage a Huawei HG532 router, particularly if your firmware is a customized variant of the device. Reports say the RustDuck botnet has used this CVE to hijack devices for DDoS attacks, which means it’s being targeted in real campaigns.

Because exploitation requires authentication, the practical risk is mainly when an attacker can log in and can reach port 37215 from a network path they control (for example, exposed admin access or insufficient firewall restrictions).

This is AMBER because it has real-world exploitation reports (RustDuck botnet using it) and can lead to full remote control of the router and business internet disruption. While it requires authentication, routers are commonly misconfigured and exposed more than owners realize.

Act now to reduce the chance of a successful login and to block access to the risky port/management paths from untrusted networks.