Description
Huawei HG630 V2 router contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain administrative access by retrieving the device serial number. Attackers can query the /api/system/deviceinfo endpoint without authentication to extract the SerialNumber field, then use the last 8 characters as the default password to log in to the router.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| www.huawei.com | HG630 V2 Router | — | — |
Advisories 1
- WID-SEC-2026-1545 Huawei Router: Schwachstelle ermöglicht Offenlegung von Informationen und Admin-Zugriff BSI CERT-Bund (WID) · May 14, 2026
References
- ExploitDB-48310 exploit
- Reference third-party-advisory
- VulnCheck Advisory: Huawei HG630 V2 Router Authentication Bypass via Serial Number third-party-advisory