PT-2014-8790 · Zte · Zte Zxdsl

Published 2014-11-20 · Updated 2018-10-09 · CVE-2014-9020

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ZTE ZXDSL versions 831 and 831CII

Description A cross-site scripting (XSS) issue exists in the Quick Stats page, specifically in the psilan.cgi component, allowing remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the domainname parameter in a save action.

Recommendations For ZTE ZXDSL versions 831 and 831CII, consider restricting access to the psilan.cgi component as a temporary workaround until a patch is available. Avoid using the domainname parameter in the affected save action to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-9020

Affected Products

Zte Zxdsl

References · 8

• 🔥 http://packetstormsecurity.com/files/129016/ZTE-831CII-Hardcoded-Credential-XSS-CSRF.html · Exploit
• 🔥 http://packetstormsecurity.com/files/129017/ZTE-ZXDSL-831-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9020 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98584 · Note
• http://securityfocus.com/bid/70984 · Note
• http://securityfocus.com/archive/1/533930/100/0/threaded · Note
• http://securityfocus.com/archive/1/533931/100/0/threaded · Note
• http://securityfocus.com/bid/70985 · Note