CVE-2017-10930

🗓️ 19 Sep 2017 14:00:00Reported by zteType

cve🔗 web.nvd.nist.gov👁 77 Views🌐 WEB

The ZXR10 1800-2S allows unauthorized access to configuration file

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2017-10930	8 Mar 202504:34	–	circl
CNVD	ZTE ZXR10 1800-2S Path Traversal Vulnerability	20 Sep 201700:00	–	cnvd
Cvelist	CVE-2017-10930	19 Sep 201714:00	–	cvelist
EUVD	EUVD-2017-2568	7 Oct 202500:30	–	euvd
NVD	CVE-2017-10930	19 Sep 201714:29	–	nvd
Prion	Design/Logic Flaw	19 Sep 201714:29	–	prion
seebug.org	中兴集成多业务路由器-ZXR10 1800-2S 敏感信息泄露漏洞	9 Oct 201700:00	–	seebug

NVD

Node

zte zxr10_1800-2s_firmwareRange<3.00.40

AND

zte zxr10_1800-2sMatch-

Node

zte zxr10_2800-4_firmwareRange<3.00.40

AND

zte zxr10_2800-4Match-

Node

zte zxr10_3800-8_firmwareRange<3.00.40

AND

zte zxr10_3800-8Match-

Node

zte zxr10_160_firmwareRange<3.00.40

AND

zte zxr10_160Match-

[
  {
    "product": "ZX10 1800-2S",
    "vendor": "ZTE",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to V3.00.40"
      }
    ]
  }
]

Source	Link
support	www.support.zte.com.cn/support/news/LoopholeInfoDetail.aspx

Parameter	Position	Path	Description	CWE
name	request body	/download.cgi	POST to download.cgi allows downloading configuration files with admin credentials exposed, enabling privilege escalation.	CWE-552
filename	request body	/download.cgi	POST to download.cgi allows downloading configuration files with admin credentials exposed, enabling privilege escalation.	CWE-552
authority	header	/pagefile/webgui/html/chinese/sys_baseinfo.htm	Unauthorized access using manipulated cookie/session to download sensitive configuration data.	CWE-552
SESSIONID	header	/pagefile/webgui/html/chinese/sys_baseinfo.htm	Unauthorized access using manipulated cookie/session to download sensitive configuration data.	CWE-552

13 May 2026 00:24Current

9High risk

Vulners AI Score9

CVSS 25

CVSS 3.19.8

EPSS0.00327

CWE-552