CVE-2017-17301

CVE-2017-17301 describes a critical weak cryptography vulnerability affecting numerous Huawei AR series routers, CloudEngine switches, and other enterprise devices across multiple firmware versions. An unauthenticated remote attacker can exploit this flaw by forging a specific RSA certificate due to improper handling of certificate values. This allows the attacker to bypass authentication, gain unauthorized access, and obtain permissions configured for a specific user. The vulnerability carries a CVSSv3 score of 9.8 (Critical), indicating a severe risk. It has a low attack complexity and requires no user interaction, allowing for complete compromise of confidentiality, integrity, and availability. The weakness stems from CWE-295 (Improper Certificate Validation). Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting a lack of widespread attention or public awareness regarding its exploitation.