PT-2017-2980 · Zte+1 · Zte Microwave Nr8000+1

Publicado 2017-09-15 · Atualizado 2025-03-07 · CVE-2017-10932

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZTE Microwave NR8000 series products versions prior to V12.17.20

Description The issue is related to Java deserialization vulnerabilities in the ZTE Microwave NR8000 series products, specifically in the applications of C/S architecture using the Java RMI service with the Apache Commons Collections (ACC) library. An unauthenticated remote attacker can exploit this by sending a crafted RMI request to execute arbitrary code on the target host. This is due to the procedure of deserializing Java objects when handling Java RMI requests.

Recommendations For versions prior to V12.17.20, update to version V12.17.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the Java RMI service to minimize the risk of exploitation.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

BDU:2017-02321

CVE-2017-10932

Produtos afetados

Apache Commons Collections

Zte Microwave Nr8000

Referências · 5

• http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008422 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-10932 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-10932 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-02321 · Nota de Segurança
• https://t.me/cvenotify/113826 · Publicação no Telegram