PT-2018-5302 · Oracle+2 · Java Rmi+2

Published 2018-07-25 · Updated 2018-10-02 · CVE-2017-10934

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZTE ZXIPTV-EPG versions prior to V5.09.02.02T4

Description The issue concerns the use of the Java RMI service with the Apache Commons Collections (ACC) library, which may lead to Java deserialization vulnerabilities. An unauthenticated remote attacker can exploit this by sending a crafted RMI request, potentially allowing the execution of arbitrary code on the target host.

Recommendations For versions prior to V5.09.02.02T4, update to version V5.09.02.02T4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Java RMI service to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2017-10934

Affected Products

Apache Commons Collections

Java Rmi

Zte Zxiptv-Epg

References · 3

• http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008682 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-10934 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10934 · Security Note