PT-2015-7493 · Zte · Zxhn H108N

Karn Ganeshen · Publicado 2015-12-30 · Atualizado 2017-09-13 · CVE-2015-7250

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108N R1A versions before ZTE.bhs.ZXHNH108NR1A.k PE

Description The issue is related to an absolute path traversal vulnerability in the cgi-bin/webproc component. This allows remote attackers to read arbitrary files by providing a full pathname in the getpage parameter.

Recommendations For versions before ZTE.bhs.ZXHNH108NR1A.k PE, update to version ZTE.bhs.ZXHNH108NR1A.k PE or later to resolve the issue. As a temporary workaround, consider restricting access to the cgi-bin/webproc component to minimize the risk of exploitation. Avoid using the getpage parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2015-7250

Produtos afetados

Zxhn H108N

Referências · 5

• 🔥 https://exploit-db.com/exploits/38773 · Exploit
• https://kb.cert.org/vuls/id/391604 · Nota
• http://securityfocus.com/bid/77421 · Nota
• https://kb.cert.org/vuls/id/BLUU-9ZDJWA · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7250 · Nota de Segurança