Vulnerabilites related to zte - zxhn_h168n
Vulnerability from fkie_nvd
Published
2021-04-13 16:15
Modified
2024-11-21 05:48
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
A ZTE product is impacted by improper access control vulnerability. The attacker could exploit this vulnerability to access CLI by brute force attacks.This affects: ZXHN H168N V3.5.0_TY.T6
References
psirt@zte.com.cnhttps://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014864Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014864Vendor Advisory
Impacted products
Vendor Product Version
zte zxhn_h168n_firmware 3.5.0_ty.t6
zte zxhn_h168n -


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:zte:zxhn_h168n_firmware:3.5.0_ty.t6:*:*:*:*:*:*:*",
                     matchCriteriaId: "9554EABB-AE2E-43B0-9F67-C10F9EAC9FDE",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:zte:zxhn_h168n:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "391EB61C-0A7B-48A6-8BBD-944C848ACD10",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A ZTE product is impacted by improper access control vulnerability. The attacker could exploit this vulnerability to access CLI by brute force attacks.This affects: ZXHN H168N V3.5.0_TY.T6",
      },
      {
         lang: "es",
         value: "Un producto ZTE está afectado por una vulnerabilidad de control de acceso inapropiado. El atacante podría explotar esta vulnerabilidad para acceder a la CLI por medio de ataques de fuerza bruta. Esto afecta a: ZXHN H168N versión V3.5.0_TY.T6",
      },
   ],
   id: "CVE-2021-21730",
   lastModified: "2024-11-21T05:48:53.793",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-04-13T16:15:12.450",
   references: [
      {
         source: "psirt@zte.com.cn",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014864",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014864",
      },
   ],
   sourceIdentifier: "psirt@zte.com.cn",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-Other",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2021-06-10 12:15
Modified
2024-11-21 05:48
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could exploit this vulnerability to obtain some sensitive user information through the wizard page without authentication. This affects ZXHN H168N all versions up to V3.5.0_EG1T4_TE.
References
psirt@zte.com.cnhttps://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015924Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015924Vendor Advisory
Impacted products
Vendor Product Version
zte zxhn_h168n_firmware *
zte zxhn_h168n -


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:zte:zxhn_h168n_firmware:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "52D73A05-D677-4AFF-86C2-A0942DF5E8A1",
                     versionEndIncluding: "3.5.0_eg1t4_te",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:zte:zxhn_h168n:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "391EB61C-0A7B-48A6-8BBD-944C848ACD10",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could exploit this vulnerability to obtain some sensitive user information through the wizard page without authentication. This affects ZXHN H168N all versions up to V3.5.0_EG1T4_TE.",
      },
      {
         lang: "es",
         value: "Un producto de ZTE tiene una vulnerabilidad de filtrado de información. Debido a una configuración inapropiada de los permisos, un atacante con permisos de usuario ordinarios podría explotar esta vulnerabilidad para obtener alguna información sensible del usuario mediante la página del asistente sin autenticación. Esto afecta al producto ZXHN H168N en todas las versiones hasta la V3.5.0_EG1T4_TE",
      },
   ],
   id: "CVE-2021-21735",
   lastModified: "2024-11-21T05:48:54.387",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "NONE",
               baseScore: 4,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-06-10T12:15:08.457",
   references: [
      {
         source: "psirt@zte.com.cn",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015924",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015924",
      },
   ],
   sourceIdentifier: "psirt@zte.com.cn",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-281",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2021-04-13 16:15
Modified
2024-11-21 05:48
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Summary
Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authorization operations by constructing messages.This affects: ZXHN H168N V3.5.0_EG1T5_TE, V2.5.5, ZXHN H108N V2.5.5_BTMT1
References
psirt@zte.com.cnhttps://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014904Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014904Vendor Advisory
Impacted products
Vendor Product Version
zte zxhn_h168n_firmware 3.5.0_eg1t5_te
zte zxhn_h168n -
zte zxhn_h108n_firmware 2.5.5_btmt1
zte zxhn_h108n -


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:zte:zxhn_h168n_firmware:3.5.0_eg1t5_te:*:*:*:*:*:*:*",
                     matchCriteriaId: "504FD446-1E1A-45DD-AB20-38C665AB4E4E",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:zte:zxhn_h168n:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "391EB61C-0A7B-48A6-8BBD-944C848ACD10",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:zte:zxhn_h108n_firmware:2.5.5_btmt1:*:*:*:*:*:*:*",
                     matchCriteriaId: "02F52956-9DFE-4FB6-887D-130E762237DA",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:zte:zxhn_h108n:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "6094FC9D-0E19-499B-8D3E-7C1BF5D7FEBD",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authorization operations by constructing messages.This affects: ZXHN H168N V3.5.0_EG1T5_TE, V2.5.5, ZXHN H108N V2.5.5_BTMT1",
      },
      {
         lang: "es",
         value: "Algunos productos ZTE presentan una vulnerabilidad de tipo CSRF. Debido a que algunas páginas presentan un fallo de verificación de valor aleatorio de CSRF, atacantes podrían llevar a cabo operaciones de autorización ilegales mediante la construcción de mensajes. Esto afecta a: ZXHN H168N versión V3.5.0_EG1T5_TE, versión V2.5.5, ZXHN H108N V2.5.5_BTMT1",
      },
   ],
   id: "CVE-2021-21729",
   lastModified: "2024-11-21T05:48:53.660",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-04-13T16:15:12.373",
   references: [
      {
         source: "psirt@zte.com.cn",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014904",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014904",
      },
   ],
   sourceIdentifier: "psirt@zte.com.cn",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-330",
            },
            {
               lang: "en",
               value: "CWE-352",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2018-11-14 15:29
Modified
2024-11-21 04:12
Severity ?
6.5 (Medium) - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
8.8 (High) - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerability, which may allow an unauthorized user to gain unauthorized access.
References
psirt@zte.com.cnhttp://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523Vendor Advisory
psirt@zte.com.cnhttps://www.exploit-db.com/exploits/45972/Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/45972/Exploit, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
zte zxhn_h168n_firmware 2.2.0_pk1.2t2
zte zxhn_h168n_firmware 2.2.0_pk1.2t5
zte zxhn_h168n_firmware 2.2.0_pk11t
zte zxhn_h168n_firmware 2.2.0_pk11t7
zte zxhn_h168n -


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:zte:zxhn_h168n_firmware:2.2.0_pk1.2t2:*:*:*:*:*:*:*",
                     matchCriteriaId: "E3076346-6FE4-4B31-AB9E-5C2D8325C5A9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:zte:zxhn_h168n_firmware:2.2.0_pk1.2t5:*:*:*:*:*:*:*",
                     matchCriteriaId: "26C8A530-ECCC-4B66-84A5-F656113DA5A4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:zte:zxhn_h168n_firmware:2.2.0_pk11t:*:*:*:*:*:*:*",
                     matchCriteriaId: "CD09C0CB-482C-4777-B2A4-98FA0F327511",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:zte:zxhn_h168n_firmware:2.2.0_pk11t7:*:*:*:*:*:*:*",
                     matchCriteriaId: "AE5DF287-E1D0-47F1-8F1D-842DF1D00019",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:zte:zxhn_h168n:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "391EB61C-0A7B-48A6-8BBD-944C848ACD10",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerability, which may allow an unauthorized user to gain unauthorized access.",
      },
      {
         lang: "es",
         value: "El producto ZTE ZXHN H168N en versiones V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 y V2.2.0_PK11T tiene una vulnerabilidad de control de acceso incorrecto, que podría permitir que un usuario no autorizado obenga acceso no autorizado.",
      },
   ],
   id: "CVE-2018-7357",
   lastModified: "2024-11-21T04:12:03.790",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "LOW",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "ADJACENT_NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 3.3,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:A/AC:L/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 6.5,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "ADJACENT_NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "psirt@zte.com.cn",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "ADJACENT_NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2018-11-14T15:29:02.187",
   references: [
      {
         source: "psirt@zte.com.cn",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523",
      },
      {
         source: "psirt@zte.com.cn",
         tags: [
            "Exploit",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.exploit-db.com/exploits/45972/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.exploit-db.com/exploits/45972/",
      },
   ],
   sourceIdentifier: "psirt@zte.com.cn",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-306",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2018-11-14 15:29
Modified
2024-11-21 04:12
Severity ?
6.5 (Medium) - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.8 (High) - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerability, which may allow an unauthorized user to perform unauthorized operations.
References
psirt@zte.com.cnhttp://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523Vendor Advisory
psirt@zte.com.cnhttp://www.securityfocus.com/bid/105963Third Party Advisory, VDB Entry
psirt@zte.com.cnhttps://www.exploit-db.com/exploits/45972/Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/105963Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/45972/Exploit, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
zte zxhn_h168n_firmware 2.2.0_pk1.2t2
zte zxhn_h168n_firmware 2.2.0_pk1.2t5
zte zxhn_h168n_firmware 2.2.0_pk11t
zte zxhn_h168n_firmware 2.2.0_pk11t7
zte zxhn_h168n -


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:zte:zxhn_h168n_firmware:2.2.0_pk1.2t2:*:*:*:*:*:*:*",
                     matchCriteriaId: "E3076346-6FE4-4B31-AB9E-5C2D8325C5A9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:zte:zxhn_h168n_firmware:2.2.0_pk1.2t5:*:*:*:*:*:*:*",
                     matchCriteriaId: "26C8A530-ECCC-4B66-84A5-F656113DA5A4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:zte:zxhn_h168n_firmware:2.2.0_pk11t:*:*:*:*:*:*:*",
                     matchCriteriaId: "CD09C0CB-482C-4777-B2A4-98FA0F327511",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:zte:zxhn_h168n_firmware:2.2.0_pk11t7:*:*:*:*:*:*:*",
                     matchCriteriaId: "AE5DF287-E1D0-47F1-8F1D-842DF1D00019",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:zte:zxhn_h168n:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "391EB61C-0A7B-48A6-8BBD-944C848ACD10",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerability, which may allow an unauthorized user to perform unauthorized operations.",
      },
      {
         lang: "es",
         value: "El producto ZTE ZXHN H168N en versiones V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 y V2.2.0_PK11T tiene una vulnerabilidad de control de cambios incorrecto, que podría permitir que un usuario no autorizado realice acciones no autorizadas.",
      },
   ],
   id: "CVE-2018-7358",
   lastModified: "2024-11-21T04:12:03.917",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "ADJACENT_NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 5.8,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:A/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 6.5,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "ADJACENT_NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "psirt@zte.com.cn",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "ADJACENT_NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2018-11-14T15:29:02.220",
   references: [
      {
         source: "psirt@zte.com.cn",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523",
      },
      {
         source: "psirt@zte.com.cn",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/105963",
      },
      {
         source: "psirt@zte.com.cn",
         tags: [
            "Exploit",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.exploit-db.com/exploits/45972/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/105963",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "https://www.exploit-db.com/exploits/45972/",
      },
   ],
   sourceIdentifier: "psirt@zte.com.cn",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-287",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

cve-2021-21730
Vulnerability from cvelistv5
Published
2021-04-13 15:08
Modified
2024-08-03 18:23
Severity ?
Summary
A ZTE product is impacted by improper access control vulnerability. The attacker could exploit this vulnerability to access CLI by brute force attacks.This affects: ZXHN H168N V3.5.0_TY.T6
References
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014864x_refsource_MISC
Impacted products
Vendor Product Version
n/a ZXHN H168N Version: V3.5.0_TY.T6
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:23:29.498Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014864",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "ZXHN H168N",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "V3.5.0_TY.T6",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A ZTE product is impacted by improper access control vulnerability. The attacker could exploit this vulnerability to access CLI by brute force attacks.This affects: ZXHN H168N V3.5.0_TY.T6",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Improper Access Control",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-04-13T15:08:08",
            orgId: "6786b568-6808-4982-b61f-398b0d9679eb",
            shortName: "zte",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014864",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "psirt@zte.com.cn",
               ID: "CVE-2021-21730",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "ZXHN H168N",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "V3.5.0_TY.T6",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A ZTE product is impacted by improper access control vulnerability. The attacker could exploit this vulnerability to access CLI by brute force attacks.This affects: ZXHN H168N V3.5.0_TY.T6",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Improper Access Control",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014864",
                     refsource: "MISC",
                     url: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014864",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "6786b568-6808-4982-b61f-398b0d9679eb",
      assignerShortName: "zte",
      cveId: "CVE-2021-21730",
      datePublished: "2021-04-13T15:08:08",
      dateReserved: "2021-01-04T00:00:00",
      dateUpdated: "2024-08-03T18:23:29.498Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-21729
Vulnerability from cvelistv5
Published
2021-04-13 15:13
Modified
2024-08-03 18:23
Severity ?
Summary
Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authorization operations by constructing messages.This affects: ZXHN H168N V3.5.0_EG1T5_TE, V2.5.5, ZXHN H108N V2.5.5_BTMT1
References
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014904x_refsource_MISC
Impacted products
Vendor Product Version
n/a ZXHN H168N,ZXHN H108N Version: V3.5.0_EG1T5_TE
Version: V2.5.5_BTMT1
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:23:29.233Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014904",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "ZXHN H168N,ZXHN H108N",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "V3.5.0_EG1T5_TE",
                  },
                  {
                     status: "affected",
                     version: "V2.5.5_BTMT1",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authorization operations by constructing messages.This affects: ZXHN H168N V3.5.0_EG1T5_TE, V2.5.5, ZXHN H108N V2.5.5_BTMT1",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "CSRF",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-04-13T15:13:26",
            orgId: "6786b568-6808-4982-b61f-398b0d9679eb",
            shortName: "zte",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014904",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "psirt@zte.com.cn",
               ID: "CVE-2021-21729",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "ZXHN H168N,ZXHN H108N",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "V3.5.0_EG1T5_TE",
                                       },
                                       {
                                          version_value: "V2.5.5_BTMT1",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authorization operations by constructing messages.This affects: ZXHN H168N V3.5.0_EG1T5_TE, V2.5.5, ZXHN H108N V2.5.5_BTMT1",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CSRF",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014904",
                     refsource: "MISC",
                     url: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1014904",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "6786b568-6808-4982-b61f-398b0d9679eb",
      assignerShortName: "zte",
      cveId: "CVE-2021-21729",
      datePublished: "2021-04-13T15:13:26",
      dateReserved: "2021-01-04T00:00:00",
      dateUpdated: "2024-08-03T18:23:29.233Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-21735
Vulnerability from cvelistv5
Published
2021-06-10 11:18
Modified
2024-08-03 18:23
Severity ?
Summary
A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could exploit this vulnerability to obtain some sensitive user information through the wizard page without authentication. This affects ZXHN H168N all versions up to V3.5.0_EG1T4_TE.
References
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015924x_refsource_MISC
Impacted products
Vendor Product Version
n/a ZXHN H168N Version: All versions up to V3.5.0_EG1T4_TE
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:23:28.226Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015924",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "ZXHN H168N",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "All versions up to V3.5.0_EG1T4_TE",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could exploit this vulnerability to obtain some sensitive user information through the wizard page without authentication. This affects ZXHN H168N all versions up to V3.5.0_EG1T4_TE.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "information leak",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-06-10T11:18:23",
            orgId: "6786b568-6808-4982-b61f-398b0d9679eb",
            shortName: "zte",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015924",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "psirt@zte.com.cn",
               ID: "CVE-2021-21735",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "ZXHN H168N",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "All versions up to V3.5.0_EG1T4_TE",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could exploit this vulnerability to obtain some sensitive user information through the wizard page without authentication. This affects ZXHN H168N all versions up to V3.5.0_EG1T4_TE.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "information leak",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015924",
                     refsource: "MISC",
                     url: "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015924",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "6786b568-6808-4982-b61f-398b0d9679eb",
      assignerShortName: "zte",
      cveId: "CVE-2021-21735",
      datePublished: "2021-06-10T11:18:23",
      dateReserved: "2021-01-04T00:00:00",
      dateUpdated: "2024-08-03T18:23:28.226Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-7357
Vulnerability from cvelistv5
Published
2018-11-14 15:00
Modified
2024-08-05 06:24
Severity ?
6.5 (Medium) - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerability, which may allow an unauthorized user to gain unauthorized access.
References
https://www.exploit-db.com/exploits/45972/exploit, x_refsource_EXPLOIT-DB
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523x_refsource_CONFIRM
Impacted products
Vendor Product Version
ZTE ZXHN H168N Version: V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T06:24:12.002Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "45972",
                  tags: [
                     "exploit",
                     "x_refsource_EXPLOIT-DB",
                     "x_transferred",
                  ],
                  url: "https://www.exploit-db.com/exploits/45972/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "ZXHN H168N",
               vendor: "ZTE",
               versions: [
                  {
                     status: "affected",
                     version: "V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T",
                  },
               ],
            },
         ],
         datePublic: "2018-11-14T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerability, which may allow an unauthorized user to gain unauthorized access.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "ADJACENT_NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Improper Authorization\n",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-12-12T10:57:01",
            orgId: "6786b568-6808-4982-b61f-398b0d9679eb",
            shortName: "zte",
         },
         references: [
            {
               name: "45972",
               tags: [
                  "exploit",
                  "x_refsource_EXPLOIT-DB",
               ],
               url: "https://www.exploit-db.com/exploits/45972/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "psirt@zte.com.cn",
               ID: "CVE-2018-7357",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "ZXHN H168N",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "ZTE",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerability, which may allow an unauthorized user to gain unauthorized access.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "ADJACENT_NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Improper Authorization\n",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "45972",
                     refsource: "EXPLOIT-DB",
                     url: "https://www.exploit-db.com/exploits/45972/",
                  },
                  {
                     name: "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523",
                     refsource: "CONFIRM",
                     url: "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523",
                  },
               ],
            },
            source: {
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "6786b568-6808-4982-b61f-398b0d9679eb",
      assignerShortName: "zte",
      cveId: "CVE-2018-7357",
      datePublished: "2018-11-14T15:00:00",
      dateReserved: "2018-02-22T00:00:00",
      dateUpdated: "2024-08-05T06:24:12.002Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-7358
Vulnerability from cvelistv5
Published
2018-11-14 15:00
Modified
2024-08-05 06:24
Severity ?
6.5 (Medium) - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerability, which may allow an unauthorized user to perform unauthorized operations.
References
http://www.securityfocus.com/bid/105963vdb-entry, x_refsource_BID
https://www.exploit-db.com/exploits/45972/exploit, x_refsource_EXPLOIT-DB
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523x_refsource_CONFIRM
Impacted products
Vendor Product Version
ZTE ZXHN H168N Version: V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T06:24:11.858Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "105963",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105963",
               },
               {
                  name: "45972",
                  tags: [
                     "exploit",
                     "x_refsource_EXPLOIT-DB",
                     "x_transferred",
                  ],
                  url: "https://www.exploit-db.com/exploits/45972/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "ZXHN H168N",
               vendor: "ZTE",
               versions: [
                  {
                     status: "affected",
                     version: "V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T",
                  },
               ],
            },
         ],
         datePublic: "2018-11-14T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerability, which may allow an unauthorized user to perform unauthorized operations.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "ADJACENT_NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Improper Authorization\n",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-12-12T10:57:01",
            orgId: "6786b568-6808-4982-b61f-398b0d9679eb",
            shortName: "zte",
         },
         references: [
            {
               name: "105963",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105963",
            },
            {
               name: "45972",
               tags: [
                  "exploit",
                  "x_refsource_EXPLOIT-DB",
               ],
               url: "https://www.exploit-db.com/exploits/45972/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "psirt@zte.com.cn",
               ID: "CVE-2018-7358",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "ZXHN H168N",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "ZTE",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerability, which may allow an unauthorized user to perform unauthorized operations.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "ADJACENT_NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Improper Authorization\n",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "105963",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105963",
                  },
                  {
                     name: "45972",
                     refsource: "EXPLOIT-DB",
                     url: "https://www.exploit-db.com/exploits/45972/",
                  },
                  {
                     name: "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523",
                     refsource: "CONFIRM",
                     url: "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523",
                  },
               ],
            },
            source: {
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "6786b568-6808-4982-b61f-398b0d9679eb",
      assignerShortName: "zte",
      cveId: "CVE-2018-7358",
      datePublished: "2018-11-14T15:00:00",
      dateReserved: "2018-02-22T00:00:00",
      dateUpdated: "2024-08-05T06:24:11.858Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}