Zixian

The issue is related to a CSRF vulnerability in the mc-admin/conf.php file. This vulnerability can be exploited to change the administrator account password.

The issue affects Huawei WS331a routers, allowing remote attackers to hijack the authentication of administrators. This can be done through cross-site request forgery (CSRF) vulnerabilities for requests that restore factory settings or reboot the device.

The issue allows remote attackers to bypass authentication and obtain administrative access by sending special packages to the LAN interface.

A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to "goform/SysToolReboot".

The issue concerns the lack of authentication for TELNET sessions, allowing remote attackers to gain equipment management authority via TCP traffic to port 23. This can enable a remote attacker to manage the device with root privileges.