ZXHN-F660T and ZXHN-F660A use a common credential for all installations

Overview ZXHN-F660T and ZXHN-F660A provided by ZTE Japan. K.K. are ONU Optical Network Unit. ZXHN-F660T and ZXHN-F660A contain the following vulnerability. Use a common credential for all installations CWE-1391 - CVE-2025-53558 Yuuki Miyata of YuukiJapanTech reported this vulnerability to IPA...

CVE-2025-53558

ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices...

CVE-2025-53558

ZXHN-F660T and ZXHN-F660A (ZTE Japan K.K.) are affected by CVE-2025-53558 due to a common default credential shared across installations. With knowledge of this credential, an attacker can log in to the device management interfaces. Documented impacts indicate unauthorized access to the devices; ...

CVE-2025-53558

ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices...

EUVD-2025-23239

ZXHN-F660T and ZXHN-F660A provided by ZTE Japan K.K. use a common credential for all installations. With the knowledge of the credential, an attacker may log in to the affected devices...

PT-2025-31477 · Zte · Zxhn-F660T +1

Name of the Vulnerable Software and Affected Versions: ZXHN-F660T ZXHN-F660A Description: ZXHN-F660T and ZXHN-F660A devices provided by ZTE Japan K.K. utilize a common credential for all installations. An attacker with knowledge of this credential may gain login access to affected devices...

NewStart CGSL MAIN 7.02 : yajl Vulnerability (NS-SA-2025-0202)

The remote NewStart CGSL host, running version MAIN 7.02, has yajl packages installed that are affected by a vulnerability: - There's a memory leak in yajl 2.1.0 with use of yajltreeparse function. which will cause out-of-memory in server and cause crash. CVE-2023-33460 Note that Nessus has not...

NewStart CGSL MAIN 7.02 : expat Vulnerability (NS-SA-2025-0123)

The remote NewStart CGSL host, running version MAIN 7.02, has expat packages installed that are affected by a vulnerability: - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate. CVE-2024-28757 Note...

NewStart CGSL MAIN 7.02 : gtk2 Vulnerability (NS-SA-2025-0110)

The remote NewStart CGSL host, running version MAIN 7.02, has gtk2 packages installed that are affected by a vulnerability: - A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory...

NewStart CGSL MAIN 7.02 : freeglut Vulnerability (NS-SA-2025-0168)

The remote NewStart CGSL host, running version MAIN 7.02, has freeglut packages installed that are affected by a vulnerability: - freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddMenuEntry function. CVE-2024-24259 Note that Nessus has not...

NewStart CGSL MAIN 7.02 : sysstat Vulnerability (NS-SA-2025-0201)

The remote NewStart CGSL host, running version MAIN 7.02, has sysstat packages installed that are affected by a vulnerability: - sysstat through 12.7.2 allows a multiplication integer overflow in checkoverflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377...

CVE-2024-45415

The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in checkdataintegrity function. This function is responsible for validating the checksum of data in post request. The checksum is sent encrypted in the request, the function decrypts it and stores the checksu...

CVE-2024-45413

The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsadecrypt function. This function is an API wrapper for LUA to decrypt RSA encrypted ciphertext, the decrypted data is stored on the stack without checking its length. An authenticated attacker can get RC...

CVE-2024-45414

The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function. This function is responsible for decrypting RSA encrypted ciphertext, the encrypted data is supplied base64 encoded. The decoded ciphertext is stored on the stack without checki...

CVE-2024-45416

The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in sessioninit function. The session -LUA- files are stored in the directory /var/luasession, the function iterates on all files in this directory and executes them using the function dofile without any validation i...

CVE-2024-22068

Improper Privilege Management vulnerability in ZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series on 64 bit allows Functionality Bypass.This issue affects ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series: V4.00.10 and earlier...

CVE-2024-22067

ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an authenticated attacker may exploit the vulnerability to execute arbitrary commands...

CVE-2024-22065

There is a command injection vulnerability in ZTE MF258 Pro product. Due to insufficient validation of Ping Diagnosis interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands...

CVE-2023-41784

Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro...

CVE-2023-41780

There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploit this vulnerability to escalate local privileges...