PT-2014-8557 · Zte · Zte Zxhn H108N

Published 2014-11-20 · Updated 2017-09-08 · CVE-2014-8493

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108L version 4.0.0d ZRQ GR4

Description The issue allows remote attackers to modify the CWMP configuration by sending a crafted request to "Forms/access cwmp 1".

Recommendations For ZTE ZXHN H108L version 4.0.0d ZRQ GR4, consider restricting access to the "Forms/access cwmp 1" endpoint until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-8493

Affected Products

Zte Zxhn H108N

References · 9

• 🔥 https://exploit-db.com/exploits/35272 · Exploit
• 🔥 https://exploit-db.com/exploits/35276 · Exploit
• 🔥 https://projectzero.gr/en/2014/11/zte-zxhn-h108l-authentication-bypass · Exploit
• 🔥 http://exploit-db.com/exploits/35276 · Exploit
• 🔥 http://packetstormsecurity.com/files/129139/ZTE-ZXHN-H108L-Access-Bypass.html · Exploit
• 🔥 http://exploit-db.com/exploits/35272 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Nov/46 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8493 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98733 · Note