PT-2017-7171 · Zte · Zxv10 W300

Karn Ganeshen · Publicado 2017-08-24 · Atualizado 2017-08-29 · CVE-2015-7259

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ZTE ADSL ZXV10 W300 modems versions W300V2.1.0f ER7 PE O57 through W300V2.1.0h ER7 PE O57

Description The issue allows user accounts to have multiple valid username and password pairs. This enables remote authenticated users to login to a target account via any of its username and password pairs.

Recommendations For versions W300V2.1.0f ER7 PE O57 through W300V2.1.0h ER7 PE O57, consider restricting access to user accounts to minimize the risk of exploitation by ensuring each account has a unique username and password pair. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2015-7259

Produtos afetados

Zxv10 W300

Referências · 5

• 🔥 https://exploit-db.com/exploits/38772 · Exploit
• http://packetstormsecurity.com/files/134493/ZTE-ADSL-ZXV10-W300-Authorization-Disclosure-Backdoor.html · Nota
• http://packetstormsecurity.com/files/134336/ZTE-ADSL-Authorization-Bypass-Information-Disclosure.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7259 · Nota de Segurança
• http://seclists.org/fulldisclosure/2015/Nov/48 · Nota