CVE-2017-17215Active Exploitation(huawei / hg532)

LOWCVSS 8.8 · HIGH

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Prioritize remediation for huawei hg532 systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send malicious packets to port 37215 to launch attacks. Successful exploit could lead to the remote execution of arbitrary code.

huawei CVEs Back to dashboard

3.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-20

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

hg532
hg532_firmware

Threat summary

Active exploitation appears in 4 classified signals
4 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 4 signals
Peaked 1d ago at 2 mentions (2026-02-13); latest day: 2
4 total mentions across 2 days

Affected systems

Vendors

huawei

Products

hg532hg532_firmware

1 version affected across 2 products

Deep dive

Activity timeline4 mentions / 2d

Signal classification1 categories

Active Exploitation

4100.0%

Referenced assets2 URLs

By indicator

Full discourse4 posts

Cyber_OSINT@Cyber_O51NT174d
Active Exploitation
Fortinet reports that Nexcorium targets TBK DVRs with exploitation, persistence, brute-force, and multi-architecture Mirai-style DDoS, leveraging CVE-2024-3721 and CVE-2017-17215 to illustrate rapid IoT threat evolution. https://www.fortinet.com/blog/threat-research/tracking-mirai-variant-nexcorium-a-vulnerability-driven-iot-botnet-campaign
Post summary
Fortinet reports that Nexcorium is actively exploiting CVE-2024-3721 and CVE-2017-17215 against TBK DVRs as part of an IoT botnet campaign. No PoC, fix, or technical vulnerability details are provided.
03051782
22.4K followersView on X
DFIR Radar@DFIR_Radar173d
Active Exploitation
Nexcorium Mirai variant exploits CVE-2024-3721 in TBK DVRs and end-of-life TP-Link routers for DDoS botnet expansion. Multi-architecture malware uses XOR encoding and embeds CVE-2017-17215 exploits. #DFIR_Radar https://t.co/s8rwl3TQkG
Post summary
The Nexcorium Mirai variant is actively exploiting CVE-2024-3721 on TBK DVRs and legacy TP‑Link routers, and also leveraging CVE-2017-17215, to grow a DDoS botnet, indicating real‑world attacks.
11051383
1.7K followersView on X
Loginsoft Threat Intel@Loginsoft_Intel237d
Active Exploitation
Cytellite recent detection targeting CVE-2017-17215 — Ucom CJSC Visit -- https://cti.loginsoft.com/ip/37.157.219.158 #Loginsoft #Cytellite #Cybersecurity #CVE201717215 #LOVI #ThreatIntelligence #Infosecurity #AI https://t.co/9WyLUUYaeY
Post summary
Threat intelligence reports recent detection of activity targeting CVE‑2017‑17215, implying ongoing exploitation.
0000031
19 followersView on X
Loginsoft Threat Intel@Loginsoft_Intel237d
Active Exploitation
Cytellite recent detection targeting CVE-2017-17215 — Ucom CJSC Visit -- https://cti.loginsoft.com/ip/37.157.219.158 #Loginsoft #Cytellite #Cybersecurity #CVE201717215 #LOVI #ThreatIntelligence #Infosecurity #AI https://t.co/eQvO8kBICt
Post summary
Cytellite reports recent detection of activity targeting CVE-2017-17215, indicating active exploitation in the wild, though no PoC, exploit code, patch, or detailed technical data are provided.
0000031
19 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	huawei	hg532	-	-	-
OS	huawei	hg532_firmware	-	-	-

Explore more

Back to dashboard huawei CVEs hg532 vulnerabilities

What researchers are saying

CVE-2017-17215

DFIR Radar[verified]@DFIR_RadarActive Exploitation

The Nexcorium Mirai variant is actively exploiting CVE-2024-3721 on TBK DVRs and legacy TP‑Link routers, and also leveraging CVE-2017-17215, to grow a DDoS botnet, indicating real‑world attacks.

Cyber_OSINT@Cyber_O51NTActive Exploitation

Fortinet reports that Nexcorium is actively exploiting CVE-2024-3721 and CVE-2017-17215 against TBK DVRs as part of an IoT botnet campaign. No PoC, fix, or technical vulnerability details are provided.

Loginsoft Threat Intel@Loginsoft_IntelActive Exploitation

Threat intelligence reports recent detection of activity targeting CVE‑2017‑17215, implying ongoing exploitation.

Loginsoft Threat Intel@Loginsoft_IntelActive Exploitation

Cytellite reports recent detection of activity targeting CVE-2017-17215, indicating active exploitation in the wild, though no PoC, exploit code, patch, or detailed technical data are provided.