Huawei HG630 V2 routers expose an authentication bypass that allows an attacker with no prior credentials to retrieve the device serial number via the public /api/system/deviceinfo endpoint. The last eight characters of that serial number are used as the default administrative password, so once the serial number is known the attacker can log in as the device administrator. This gives the attacker full control over routing configuration, firmware updates, and network traffic, effectively elevating an unauthenticated adversary to privileged access.

Huawei HG630 V2 Router.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is 0.00153, indicating a very low but non-zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw simply by issuing an HTTP GET to the device's /api/system/deviceinfo endpoint, which is accessible without authentication, and then attempting to log in with the derived default password. Based on the description, it is inferred that the attack vector is the network; no additional authentication or restrictions are required.