Home

Description

Huawei HG630 V2 router contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain administrative access by retrieving the device serial number. Attackers can query the /api/system/deviceinfo endpoint without authentication to extract the SerialNumber field, then use the last 8 characters as the default password to login to the router.

PUBLISHED Reserved 2026-05-13 | Published 2026-05-13 | Updated 2026-05-14 | Assigner VulnCheck




HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

Use of Hard-coded Credentials

Product status

HG630 V2
affected

Credits

Eslam Medhat finder

References

www.exploit-db.com/exploits/48310 (ExploitDB-48310) exploit

www.youtube.com/watch?v=vOrIL7L_cVc (Reference) third-party-advisory

www.vulncheck.com/...authentication-bypass-via-serial-number (VulnCheck Advisory: Huawei HG630 V2 Router Authentication Bypass via Serial Number) third-party-advisory

cve.org (CVE-2020-37220)

nvd.nist.gov (CVE-2020-37220)

Download JSON