Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ZTE ZXDSL 831 allow remote attackers to inject arbitrary web script or HTML via the 1 tr69cAcsURL, 2 tr69cAcsUser, 3 tr69cAcsPwd, 4 tr69cConnReqPwd, or 5 tr69cDebugEnable parameter to the TR-069 client page tr69cfg.cgi; the 6 timezone parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the Quick Stats page psilan.cgi in ZTE ZXDSL 831 and 831CII allows remote attackers to inject arbitrary web script or HTML via the domainname parameter in a save action. NOTE: this issue was SPLIT from CVE-2014-9021 per ADT1 due to different affected...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of administrators for requests that 1 change the admin user name or 2 conduct cross-site scripting XSS attacks via the sysUserName parameter in a save action to...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of administrators for requests that disable modem lan ports via the 1 enblftp, 2 enblhttp, 3 enblsnmp, 4 enbltelnet, 5 enbltftp, 6 enblicmp, or 7 enblssh parameter to...

CVE-2014-9021

Multiple cross-site scripting XSS vulnerabilities in ZTE ZXDSL 831 allow remote attackers to inject arbitrary web script or HTML via the 1 tr69cAcsURL, 2 tr69cAcsUser, 3 tr69cAcsPwd, 4 tr69cConnReqPwd, or 5 tr69cDebugEnable parameter to the TR-069 client page tr69cfg.cgi; the 6 timezone parameter...

CVE-2014-9019

Multiple cross-site request forgery CSRF vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of administrators for requests that 1 change the admin user name or 2 conduct cross-site scripting XSS attacks via the sysUserName parameter in a save action to...

CVE-2014-9027

Multiple cross-site request forgery CSRF vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of administrators for requests that disable modem lan ports via the 1 enblftp, 2 enblhttp, 3 enblsnmp, 4 enbltelnet, 5 enbltftp, 6 enblicmp, or 7 enblssh parameter to...

CVE-2014-9027

CVE-2014-9027 describes multiple cross-site request forgery (CSRF) vulnerabilities in the ZTE ZXDSL 831CII. The issue allows remote attackers to hijack the administrator’s session to trigger requests that disable modem LAN ports via parameters to accesslocal.cmd (enblftp, enblhttp, enblsnmp, enbl...

CVE-2014-8493

The CVE-2014-8493 issue affects ZTE ZXHN H108L devices running firmware 4.0.0d_ZRQ_GR4, where a crafted request to Forms/access_cwmp_1 can allow remote modification of CWMP configuration. The vulnerability is described as an authentication bypass enabling CWMP configuration edits without proper a...

CVE-2014-9020

CVE-2014-9020 is an XSS vulnerability affecting ZTE ZXDSL 831 and 831CII devices in the Quick Stats page (psilan.cgi). The vulnerability arises from insufficient input validation on the domainname parameter in the save action, allowing remote attackers to inject arbitrary web script or HTML. This...

CVE-2014-9019

CVE-2014-9019 describes CSRF and XSS vulnerabilities in ZTE ZXDSL 831CII. Remote attackers can hijack administrator sessions to perform actions such as changing the admin username or password via adminpasswd.cgi and can trigger XSS through the sysUserName parameter in the same save action, as wel...

CVE-2014-8493

ZTE ZXHN H108L with firmware 4.0.0dZRQGR4 allows remote attackers to modify the CWMP configuration via a crafted request to Forms/accesscwmp1...

CVE-2014-9021

CVE-2014-9021 covers multiple XSS flaws in the ZTE ZXDSL 831 family (including 831CII). Technical details from connected sources show vulnerabilities on specific UI endpoints: the TR-069 client page (tr69cfg.cgi) via parameters tr69cAcsURL, tr69cAcsUser, tr69cAcsPwd, tr69cConnReqPwd, tr69cDebugEn...

CVE-2014-9020

Cross-site scripting XSS vulnerability in the Quick Stats page psilan.cgi in ZTE ZXDSL 831 and 831CII allows remote attackers to inject arbitrary web script or HTML via the domainname parameter in a save action. NOTE: this issue was SPLIT from CVE-2014-9021 per ADT1 due to different affected...

CVE-2014-8493: Undefined Security Weakness

ZTE ZXHN H108L with firmware 4.0.0dZRQGR4 allows remote attackers to modify the CWMP configuration via a crafted request to Forms/accesscwmp1...

CVE-2014-9020: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Quick Stats page psilan.cgi in ZTE ZXDSL 831 and 831CII allows remote attackers to inject arbitrary web script or HTML via the domainname parameter in a save action. NOTE: this issue was SPLIT from CVE-2014-9021 per ADT1 due to different affected...

PT-2014-8790

Name of the Vulnerable Software and Affected Versions ZTE ZXDSL versions 831 and 831CII Description A cross-site scripting XSS issue exists in the Quick Stats page, specifically in the psilan.cgi component, allowing remote attackers to inject arbitrary web script or HTML. This is achieved by...

PT-2014-8791

Name of the Vulnerable Software and Affected Versions ZTE ZXDSL 831 affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters to...

PT-2014-8797

Name of the Vulnerable Software and Affected Versions ZTE ZXDSL 831CII affected versions not specified Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for specific...

PT-2014-8557

Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108L version 4.0.0d ZRQ GR4 Description The issue allows remote attackers to modify the CWMP configuration by sending a crafted request to "Forms/access cwmp 1". Recommendations For ZTE ZXHN H108L version 4.0.0d ZRQ GR4, consider...