PT-2018-18051 · Zte · Zxin10

Guillaume Tessier · Published 2018-12-07 · Updated 2023-03-01 · CVE-2018-7364

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZTE ZXIN10 versions prior to ZXINOS-RESV1.01.43

Description The issue is related to improper access control, specifically to the devcomm process, allowing an unauthorized remote attacker to execute arbitrary code with root privileges.

Recommendations For versions prior to ZXINOS-RESV1.01.43, update to a version newer than ZXINOS-RESV1.01.43 to resolve the issue.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2018-7364

GHSA-34F2-7H57-RG7P

Affected Products

Zxin10

References · 5

• 🔥 https://github.com/orangecertcc/security-research/security/advisories/GHSA-34f2-7h57-rg7p · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-7364 · Security Note
• http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009943 · Vendor Advisory
• https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009943 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7364 · Vendor Advisory