PT-2017-7171 · Zte · Zxv10 W300

Karn Ganeshen · Published 2017-08-24 · Updated 2017-08-29 · CVE-2015-7259

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ZTE ADSL ZXV10 W300 modems versions W300V2.1.0f ER7 PE O57 through W300V2.1.0h ER7 PE O57

Description The issue allows user accounts to have multiple valid username and password pairs. This enables remote authenticated users to login to a target account via any of its username and password pairs.

Recommendations For versions W300V2.1.0f ER7 PE O57 through W300V2.1.0h ER7 PE O57, consider restricting access to user accounts to minimize the risk of exploitation by ensuring each account has a unique username and password pair. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2015-7259

Affected Products

Zxv10 W300

References · 5

• 🔥 https://exploit-db.com/exploits/38772 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7259 · Security Note
• http://packetstormsecurity.com/files/134493/ZTE-ADSL-ZXV10-W300-Authorization-Disclosure-Backdoor.html · Note
• http://packetstormsecurity.com/files/134336/ZTE-ADSL-Authorization-Bypass-Information-Disclosure.html · Note
• http://seclists.org/fulldisclosure/2015/Nov/48 · Note