Lucene search

[email protected]CVE-2021-21734

HistoryMay 28, 2021 - 12:15 p.m.

CVE-2021-21734

2021-05-2812:15:07

CWE-312

[email protected]

web.nvd.nist.gov

cve-2021-21734

zte

pon

mdu

plaintext

security vulnerability

sensitive information

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.5%

JSON

Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command. This affects: ZTE PON MDU device ZXA10 F821 V1.7.0P3T22, ZXA10 F822 V1.4.3T6, ZXA10 F819 V1.2.1T5, ZXA10 F832 V1.1.1T7, ZXA10 F839 V1.1.0T8, ZXA10 F809 V3.2.1T1, ZXA10 F822P V1.1.1T7, ZXA10 F832 V2.00.00.01

Affected configurations

NVD

Node

ztezxa10_f821Match-

AND

ztezxa10_f821_firmwareMatch1.7.0p3t22

Node

ztezxa10_f822Match-

AND

ztezxa10_f822_firmwareMatch1.4.3t6

Node

ztezxa10_f819Match-

AND

ztezxa10_f819_firmwareMatch1.2.1t5

Node

ztezxa10_f832Match-

AND

ztezxa10_f832_firmwareMatch1.1.1t7

Node

ztezxa10_f839Match-

AND

ztezxa10_f839_firmwareMatch1.1.0t8

Node

ztezxa10_f809Match-

AND

ztezxa10_f809_firmwareMatch3.2.1t1

Node

ztezxa10_f822pMatch-

AND

ztezxa10_f822p_firmwareMatch1.1.1t7

Node

ztezxa10_f832v2Match-

AND

ztezxa10_f832v2_firmwareMatch2.00.00.01

CPENameOperatorVersion
zte:zxa10_f821_firmwarezte zxa10 f821 firmwareeq1.7.0p3t22

CPE	Name	Operator	Version
zte:zxa10_f821_firmware	zte zxa10 f821 firmware	eq	1.7.0p3t22

CNA Affected

[
  {
    "product": "ZTE PON MDU devices",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "ZXA10 F821 V1.7.0P3T22,ZXA10 F822 V1.4.3T6,ZXA10 F819 V1.2.1T5,ZXA10 F832 V1.1.1T7,ZXA10 F839 V1.1.0T8,ZXA10 F809 V3.2.1T1,ZXA10 F822P V1.1.1T7,ZXA10 F832 V2.00.00.01"
      }
    ]
  }
]

References

support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015524

Social References

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.5%

JSON

Related for CVE-2021-21734

cvelist1 prion1 nvd1