PT-2021-14742 · Zxcloud · Zxcloud Irai

Published 2021-04-13 · Updated 2025-01-28 · CVE-2021-21731

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZXCLOUD iRAI versions prior to KVM-ProductV6.03.04

Description A CSRF issue exists in the management page of the product due to insufficient verification of request origins, allowing an attacker to submit malicious requests and potentially delete data.

Recommendations For versions prior to KVM-ProductV6.03.04, update to version KVM-ProductV6.03.04 or later to resolve the issue. As a temporary workaround, consider implementing additional request validation mechanisms to verify the authenticity of requests to the management page. Restrict access to the management page to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-21731

Affected Products

Zxcloud Irai

References · 6

• https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014824 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21731 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21731 · Vendor Advisory
• https://t.me/cvenotify/13516 · Telegram Post
• https://t.me/cvenotify/108866 · Telegram Post
• https://t.me/cvenotify/13163 · Telegram Post