PT-2017-2980 · Zte+1 · Zte Microwave Nr8000+1

Published 2017-09-15 · Updated 2025-03-07 · CVE-2017-10932

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZTE Microwave NR8000 series products versions prior to V12.17.20

Description The issue is related to Java deserialization vulnerabilities in the ZTE Microwave NR8000 series products, specifically in the applications of C/S architecture using the Java RMI service with the Apache Commons Collections (ACC) library. An unauthenticated remote attacker can exploit this by sending a crafted RMI request to execute arbitrary code on the target host. This is due to the procedure of deserializing Java objects when handling Java RMI requests.

Recommendations For versions prior to V12.17.20, update to version V12.17.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the Java RMI service to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2017-02321

CVE-2017-10932

Affected Products

Apache Commons Collections

Zte Microwave Nr8000

References · 5

• http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008422 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10932 · Security Note
• https://osv.dev/vulnerability/CVE-2017-10932 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02321 · Security Note
• https://t.me/cvenotify/113826 · Telegram Post