EUVD-2018-19095

Malware in sbrugna...

ZTE ZXHN F670 Information Disclosure Vulnerability

The ZTE ZXHN F670 is a modem from China's ZTE Corporation ZTE. An information disclosure vulnerability exists in ZTE ZXHN F670 V1.1.10P3T18 and earlier versions, which can be exploited by an attacker to obtain GPON SN information with the help of appviahttp service...

Authorization

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper authorization vulnerability. Since appviahttp service has no authorization delay, an attacker can be allowed to brute force account credentials...

Null pointer dereference

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by null pointer dereference vulnerability, which may allows an attacker to cause a denial of service via appviahttp service...

CVE-2018-7361

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by null pointer dereference vulnerability, which may allows an attacker to cause a denial of service via appviahttp service...

Information disclosure

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by information exposure vulnerability, which may allow an unauthenticated attacker to get the GPON SN information via appviahttp service...

CVE-2018-7360

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by information exposure vulnerability, which may allow an unauthenticated attacker to get the GPON SN information via appviahttp service...

CVE-2018-7363

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper authorization vulnerability. Since appviahttp service has no authorization delay, an attacker can be allowed to brute force account credentials...

CVE-2018-7363

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper authorization vulnerability. Since appviahttp service has no authorization delay, an attacker can be allowed to brute force account credentials...

CVE-2018-7361

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by null pointer dereference vulnerability, which may allows an attacker to cause a denial of service via appviahttp service...

CVE-2018-7360

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by information exposure vulnerability, which may allow an unauthenticated attacker to get the GPON SN information via appviahttp service...

CVE-2018-7360

The CVE-2018-7360 entry concerns the ZTE ZXHN F670 modem (V1.1.10P3T18 and earlier). Affected component: appviahttp service leading to an information exposure vulnerability that could allow an unauthenticated attacker to obtain the GPON SN. The connected CNVD/EUVD entries corroborate that the iss...

CVE-2018-7361: NULL Pointer Dereference

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by null pointer dereference vulnerability, which may allows an attacker to cause a denial of service via appviahttp service...

PT-2018-18048

Name of the Vulnerable Software and Affected Versions ZTE ZXHN F670 versions prior to V1.1.10P3T18 Description The issue is related to a null pointer dereference, which may allow an attacker to cause a denial of service via the appviahttp service. Recommendations For versions prior to V1.1.10P3T1...

CVE-2018-7363: Incorrect Authorization

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper authorization vulnerability. Since appviahttp service has no authorization delay, an attacker can be allowed to brute force account credentials...

PT-2018-18047

Name of the Vulnerable Software and Affected Versions ZTE ZXHN F670 versions prior to V1.1.10P3T18 Description The issue allows an unauthenticated attacker to obtain the GPON SN information via the appviahttp service, potentially leading to information exposure. Recommendations For versions prior...

PT-2018-18050

Name of the Vulnerable Software and Affected Versions ZTE ZXHN F670 versions prior to V1.1.10P3T18 Description The issue is related to improper authorization, allowing an attacker to brute force account credentials due to the lack of authorization delay in the appviahttp service. Recommendations...

CVE-2018-7360: Exposure of Sensitive Information to an Unauthorized Actor

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by information exposure vulnerability, which may allow an unauthenticated attacker to get the GPON SN information via appviahttp service...