PT-2017-7170 · Zte · Zxv10 W300

Karn Ganeshen · Published 2017-08-24 · Updated 2017-08-30 · CVE-2015-7258

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ZTE ADSL ZXV10 W300 modems versions W300V2.1.0f ER7 PE O57 through W300V2.1.0h ER7 PE O57

Description The issue allows remote authenticated users to obtain user passwords by displaying user information in a Telnet connection.

Recommendations For versions W300V2.1.0f ER7 PE O57 through W300V2.1.0h ER7 PE O57, consider restricting Telnet access to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2015-7258

Affected Products

Zxv10 W300

References · 5

• 🔥 https://exploit-db.com/exploits/38772 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7258 · Security Note
• http://packetstormsecurity.com/files/134493/ZTE-ADSL-ZXV10-W300-Authorization-Disclosure-Backdoor.html · Note
• http://packetstormsecurity.com/files/134336/ZTE-ADSL-Authorization-Bypass-Information-Disclosure.html · Note
• http://seclists.org/fulldisclosure/2015/Nov/48 · Note