PT-2021-14747 · Zte · Zxhn Hs562

Published 2021-06-10 · Updated 2021-06-17 · CVE-2021-21736

Positive Technologies (AI Summary)

CVSS v2.0

8.0

High

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions ZXHN HS562 versions V1.0.0.0B2.0000 through V1.0.0.0B3.0000E

Description A permission and access control issue affects a smart camera product of ZTE. The cloud-end app has a defect in user permission management, allowing users whose sharing permissions have been revoked to still control the camera. This includes actions such as restarting the camera and restoring factory settings.

Recommendations For versions V1.0.0.0B2.0000 and V1.0.0.0B3.0000E, consider restricting access to the camera's control features until a patch is available. As a temporary workaround, disable the ability to restart the camera and restore factory settings remotely for users whose sharing permissions have been revoked.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2021-21736

Affected Products

Zxhn Hs562

References · 4

• https://osv.dev/vulnerability/CVE-2021-21736 · Vendor Advisory
• https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015964 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21736 · Security Note
• https://t.me/cvenotify/16074 · Telegram Post