PT-2014-3562 · Zte · Zte Zxv10 W300

Published 2014-02-04 · Updated 2017-08-29 · CVE-2014-0329

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ZTE ZXV10 W300 router version 2.1.0

Description The issue concerns a hardcoded password for the admin account in the TELNET service, which can be determined by knowing the MAC address characters at the beginning of the password, allowing remote attackers to gain administrative access.

Recommendations For ZTE ZXV10 W300 router version 2.1.0, consider changing the admin account password to a strong, unique password to prevent unauthorized access. As a temporary workaround, restrict access to the TELNET service until a more secure configuration can be implemented.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2014-0329

Affected Products

Zte Zxv10 W300

References · 8

• 🔥 https://exploit-db.com/exploits/31527 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-0329 · Security Note
• http://blog.alguien.at/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html · Note
• http://kb.cert.org/vuls/id/228886 · Note
• http://osvdb.org/102816 · Note
• http://securityfocus.com/bid/65310 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90958 · Note
• http://packetstormsecurity.com/files/125142/ZTE-ZXV10-W300-Hardcoded-Credentials.html · Note