PatchSiren cyber security CVE debrief
CVE-2020-37220 www.huawei.com CVE debrief
CVE-2020-37220 describes an authentication bypass vulnerability in the Huawei HG630 V2 router. The device exposes the /api/system/deviceinfo endpoint without requiring authentication, allowing unauthenticated attackers to retrieve the device serial number. The last 8 characters of this serial number serve as the default administrative password, enabling complete administrative access to the router. This vulnerability represents a critical weakness in default credential generation and information disclosure, as the authentication mechanism relies on predictable, device-derived credentials that are trivially obtainable.
- Vendor
- www.huawei.com
- Product
- HG630 V2 Router
- CVSS
- HIGH 8.7
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-13
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-13
- Advisory updated
- 2026-05-26
Who should care
Network administrators managing Huawei HG630 V2 deployments, residential ISP customers using affected devices, security teams responsible for SOHO network security, and telecommunications providers distributing these routers to subscribers
Technical summary
The Huawei HG630 V2 router exposes device information through an unauthenticated API endpoint at /api/system/deviceinfo. This endpoint returns system details including the SerialNumber field. The device's default administrative password is derived from the last 8 characters of this serial number. An attacker with network access to the router can query this endpoint without credentials, extract the serial number, derive the administrative password, and gain complete control over the device. The vulnerability stems from predictable credential generation combined with information disclosure through an unprotected API.
Defensive priority
HIGH
Recommended defensive actions
- Restrict network access to router administrative interfaces to trusted management networks only
- Implement network segmentation to isolate residential gateway devices from untrusted network segments
- Monitor for unauthorized access attempts to /api/system/deviceinfo endpoint
- Change default administrative credentials immediately upon device deployment if serial number-based passwords are suspected
- Contact Huawei support for firmware updates addressing this authentication bypass
- Consider replacing affected devices if vendor patches are unavailable
Evidence notes
Vulnerability disclosed via VulnCheck advisory and Exploit-DB. CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, and high confidentiality impact. CWE-798 (Use of Hard-coded Credentials) identified as secondary weakness classification. NVD status marked as 'Deferred' as of last modification.
Official resources
2026-05-13