A hard-coded weak password vulnerability has been discovered in all Magic-branded devices from H3C Technologies. The vulnerability stems from the use of a hard-coded weak password for the root account in the /etc/shadow configuration or even the absence of any password at all. Some of these devices have the Telnet service enabled by default, or users can choose to enable the Telnet service in other device management interfaces (e.g. /debug.asp or /debug_telnet.asp). In addition, these devices have related interfaces called Virtual Servers, which can map the devices to the public network, posing the risk of remote attacks. Therefore, attackers can obtain the highest root privileges of the devices through the Telnet service using the weak password hardcoded in the firmware (or without a password), and remote attacks are possible.
R Series (Chinese Version) : R160 ≤ V100R005 / R500 ≤ V100R006 / R1510 ≤ V100R015 / R3000 ≤ V100R011 / R3010 ≤ V100R009
B Series (Chinese Version) : B0 ≤ V100R002 / B1 ≤ V100R004 / B3 ≤ V100R002 / B5 ≤ V100R007 / B6 ≤ V100R004 / BX54 ≤ V100R004 / BX54-E ≤ V100R012 / BX30 ≤ V100R002 / BE18000 ≤ V200R006
N Series (Chinese Version) : N12 ≤ V100R006 / NX15 ≤ V100R017 / NX18 ≤ V100R007 / NX30 ≤ V100R012 / NX30-Pro ≤ V100R010 / NX54 ≤ V100R013 / NX400 ≤ V100R014 / NX600 ≤ V100R012 / NE36-Pro ≤ V100R002 / NX15000 ≤ V100R007
Global Version : NX15 ≤ EUV100R007 / NX30 ≤ EUV100R007/ NX54 ≤ EUV100R005 / BX54 ≤ EUV100R002
*Download Link : https://www.h3c.com/en/Support/Resource_Center/Software_Download/Intelligent_Terminal/
https://www.h3c.com/cn/Service/Document_Software/Software_Download/Consume_product/
Also, download the latest firmware from http://h3c-magic.oss-cn-hangzhou.aliyuncs.com/gateway-version/{firmware_version}, for example, http://h3c-magic.oss-cn-hangzhou.aliyuncs.com/gateway-version/BX30V100R002.bin.
In these firmware, for most device (such as NX30), the /etc/passwd configuration file is as follows.
root:x:0:0:root:/root:/bin/ash
daemon:*:1:1:daemon:/var:/bin/false
ftp:*:55:55:ftp:/home/ftp:/bin/false
network:*:101:101:network:/var:/bin/false
nobody:*:65534:65534:nobody:/var:/bin/false
dnsmasq:x:453:453:dnsmasq:/var/run/dnsmasq:/bin/false
lldp:x:121:129:lldp:/var/run/lldp:/bin/false
Among them, by logging in with the root account, we can enter the /bin/ash shell.
In addition, their corresponding configuration content in /etc/shadow is as follows.
root::0:0:99999:7:::
daemon:*:0:0:99999:7:::
ftp:*:0:0:99999:7:::
network:*:0:0:99999:7:::
nobody:*:0:0:99999:7:::
dnsmasq:x:0:0:99999:7:::
lldp:x:0:0:99999:7:::
Incredibly, the root account, which represents the highest authority, does not require a password.
For some other possibly newer device (such as BE18000), their /etc/passwd and /etc/shadow configurations are as follows respectively.
root:x:0:0:root:/root:/bin/ash
admin:x:0:0:root:/root:/bin/false
H3C:x:0:0:root:/root:/bin/ash
daemon:*:1:1:daemon:/var:/bin/false
ftp:*:55:55:ftp:/home/ftp:/bin/false
network:*:101:101:network:/var:/bin/false
nobody:*:65534:65534:nobody:/var:/bin/false
dnsmasq:x:453:453:dnsmasq:/var/run/dnsmasq:/bin/false
mosquitto:x:200:200:mosquitto:/var/run/mosquitto:/bin/false