Lucene search

[email protected]CVE-2021-21723

HistoryJan 26, 2021 - 6:16 p.m.

CVE-2021-21723

2021-01-2618:16:18

CWE-401

[email protected]

web.nvd.nist.gov

cve-2021-21723

zte

dos

vulnerability

memory release

remote attacker

memory leak

device denial of service

zxr10 9904

zxr10 9908

zxr10 9916

zxr10 9904-s

zxr10 9908-s

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.8%

JSON

Some ZTE products have a DoS vulnerability. Due to the improper handling of memory release in some specific scenarios, a remote attacker can trigger the vulnerability by performing a series of operations, resulting in memory leak, which may eventually lead to device denial of service. This affects: ZXR10 9904, ZXR10 9908, ZXR10 9916, ZXR10 9904-S, ZXR10 9908-S; all versions up to V1.01.10.B12.

Affected configurations

NVD

Node

ztezxr10_9904Match-

AND

ztezxr10_9904_firmwareRange≤v1.01.10.b12

Node

ztezxr10_9908Match-

AND

ztezxr10_9908_firmwareRange≤v1.01.10.b12

Node

ztezxr10_9916Match-

AND

ztezxr10_9916_firmwareRange≤v1.01.10.b12

Node

ztezxr10_9904-sMatch-

AND

ztezxr10_9904-s_firmwareRange≤v1.01.10.b12

Node

ztezxr10_9908-sMatch-

AND

ztezxr10_9908-s_firmwareRange≤v1.01.10.b12

CPENameOperatorVersion
zte:zxr10_9904_firmwarezte zxr10 9904 firmwarelev1.01.10.b12

CPE	Name	Operator	Version
zte:zxr10_9904_firmware	zte zxr10 9904 firmware	le	v1.01.10.b12

CNA Affected

[
  {
    "product": "<ZXR10 9904, ZXR10 9908, ZXR10 9916, ZXR10 9904-S, ZXR10 9908-S>",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "<all versions up to V1.01.10.B12>"
      }
    ]
  }
]

References

support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014424

Social References

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.8%

JSON

Related for CVE-2021-21723

cvelist1 nvd1 prion1