Lucene search

CertccCVE-2015-7259

HistoryAug 24, 2017 - 8:29 p.m.

CVE-2015-7259

2017-08-2420:29:00

CWE-255

certcc

web.nvd.nist.gov

zte

zxv10

w300

modem

security vulnerability

cve-2015-7259

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.003

Percentile

68.8%

JSON

ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid username and password pairs, which allows remote authenticated users to login to a target account via any of its username and password pairs.

Affected configurations

Nvd

Node

ztezxv10_w300_firmwareMatchw300v2.1.0f_er7_pe_o57

AND

ztezxv10_w300Match-

Node

ztezxv10_w300_firmwareMatchw300v2.1.0h_er7_pe_o57

AND

ztezxv10_w300Match-

VendorProductVersionCPE
ztezxv10_w300_firmwarew300v2.1.0f_er7_pe_o57cpe:2.3:o:zte:zxv10_w300_firmware:w300v2.1.0f_er7_pe_o57:*:*:*:*:*:*:*
ztezxv10_w300-cpe:2.3:h:zte:zxv10_w300:-:*:*:*:*:*:*:*
ztezxv10_w300_firmwarew300v2.1.0h_er7_pe_o57cpe:2.3:o:zte:zxv10_w300_firmware:w300v2.1.0h_er7_pe_o57:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zte	zxv10_w300_firmware	w300v2.1.0f_er7_pe_o57	cpe:2.3:o:zte:zxv10_w300_firmware:w300v2.1.0f_er7_pe_o57:::::::*
zte	zxv10_w300	-	cpe:2.3:h:zte:zxv10_w300:-:::::::*
zte	zxv10_w300_firmware	w300v2.1.0h_er7_pe_o57	cpe:2.3:o:zte:zxv10_w300_firmware:w300v2.1.0h_er7_pe_o57:::::::*

References

packetstormsecurity.com/files/134336/ZTE-ADSL-Authorization-Bypass-Information-Disclosure.html

packetstormsecurity.com/files/134493/ZTE-ADSL-ZXV10-W300-Authorization-Disclosure-Backdoor.html

seclists.org/fulldisclosure/2015/Nov/48

www.exploit-db.com/exploits/38772/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

EPSS

0.003

Percentile

68.8%

JSON

Related for CVE-2015-7259