ZTE ROSNG Compliance Checks

Binary data ztecompliancecheck.nbin...

ZTE E8810 Information Disclosure Vulnerability

ZTE E8810 is a smart cloud router from ZTE China. The ZTE E8810 suffers from a hard-coded MQTT service vulnerability that can be exploited by remote attackers to submit a special request for unauthorized access to the MQTT server and obtain sensitive information...

CVE-2020-6881

ZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability, which is caused by the failure of the device to verify the validity of abnormal messages. A remote attacker could connect to the MQTT server and send an MQTT exception message to the specified device, which will cause the device...

CVE-2020-6882

ZTE E8810/E8820/E8822 series routers have an information leak vulnerability, which is caused by hard-coded MQTT service access credentials on the device. The remote attacker could use this credential to connect to the MQTT server, so as to obtain information about other devices by sending specifi...

CVE-2020-6881

ZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability, which is caused by the failure of the device to verify the validity of abnormal messages. A remote attacker could connect to the MQTT server and send an MQTT exception message to the specified device, which will cause the device...

CVE-2020-6882

ZTE E8810/E8820/E8822 series routers have an information leak vulnerability, which is caused by hard-coded MQTT service access credentials on the device. The remote attacker could use this credential to connect to the MQTT server, so as to obtain information about other devices by sending specifi...

Design/Logic Flaw

ZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability, which is caused by the failure of the device to verify the validity of abnormal messages. A remote attacker could connect to the MQTT server and send an MQTT exception message to the specified device, which will cause the device...

Design/Logic Flaw

ZTE E8810/E8820/E8822 series routers have an information leak vulnerability, which is caused by hard-coded MQTT service access credentials on the device. The remote attacker could use this credential to connect to the MQTT server, so as to obtain information about other devices by sending specifi...

CVE-2020-6882

The CVE-2020-6882 entry describes a hard-coded MQTT credentials information-disclosure vulnerability in ZTE E8810/E8820/E8822 series routers. The root cause is hard-coded MQTT service access credentials on the device, enabling a remote attacker to connect to the MQTT server and access information...

CVE-2020-6882

ZTE E8810/E8820/E8822 series routers have an information leak vulnerability, which is caused by hard-coded MQTT service access credentials on the device. The remote attacker could use this credential to connect to the MQTT server, so as to obtain information about other devices by sending specifi...

CVE-2020-6881

CVE-2020-6881 concerns ZTE ZXHN E8810/E8820/E8822 series routers. The MQTT DoS arises from the device failing to verify the validity of abnormal MQTT messages, allowing a remote attacker to connect to the MQTT server and send an exception message that leads to denial of service. Affected versions...

CVE-2020-6881

ZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability, which is caused by the failure of the device to verify the validity of abnormal messages. A remote attacker could connect to the MQTT server and send an MQTT exception message to the specified device, which will cause the device...

ZTE E8810/E8820/E8822 series 信息泄露漏洞

ZTE E8810 is a smart cloud router from ZTE China. The ZTE E8810 suffers from a hard-coded MQTT service vulnerability that can be exploited by remote attackers to submit a special request for unauthorized access to the MQTT server and obtain sensitive information...

ZTE Multiple Products Access Control Error Vulnerability

The ZTE E8810 and others are a smart cloud router from the Chinese company ZTE. A security vulnerability exists in the ZTE E8810/E8820/E8822 series, which is caused by the device's inability to verify the validity of an exception message. A remote attacker could use this vulnerability to connect ...

NewStart CGSL CORE 5.05 / MAIN 5.05 : file Vulnerability (NS-SA-2020-0105)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has file packages installed that are affected by a vulnerability: - The docorenote function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service out-of-bounds read and application crash v...

NewStart CGSL CORE 5.05 / MAIN 5.05 : doxygen Vulnerability (NS-SA-2020-0107)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has doxygen packages installed that are affected by a vulnerability: - Insufficient sanitization of the query parameter in templates/html/searchopensearch.php could lead to reflected cross-site scripting or iframe injection...

NewStart CGSL CORE 5.05 / MAIN 5.05 : bash Vulnerability (NS-SA-2020-0101)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has bash packages installed that are affected by a vulnerability: - rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASHCMDS, thus allowing the user to execute any command with the permissions of th...

NewStart CGSL CORE 5.05 / MAIN 5.05 : ppp Vulnerability (NS-SA-2020-0113)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ppp packages installed that are affected by a vulnerability: - eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eaprequest and eapresponse functions. CVE-2020-8597 Note that Nessus has not...

NewStart CGSL CORE 5.04 / MAIN 5.04 : libqb Vulnerability (NS-SA-2020-0057)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libqb packages installed that are affected by a vulnerability: - libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses predictable filenames under /dev/shm and /tmp without...

NewStart CGSL CORE 5.05 / MAIN 5.05 : http-parser Vulnerability (NS-SA-2020-0119)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has http-parser packages installed that are affected by a vulnerability: - HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed CVE-2019-15605 Note that Nessus h...