Description

There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerability to delete the default application type, which affects normal use of system.

Related CPE's

o

zte

zxa10_b76hv3_firmware

Vulnerable

h

zte

zxa10_b76hv3

-

o

zte

zxa10_b766v2_firmware

Vulnerable

h

zte

zxa10_b766v2

-

o

zte

zxa10_b800v2_firmware

Vulnerable

h

zte

zxa10_b800v2

-

o

zte

zxa10_b860av2.1_firmware

Vulnerable

h

zte

zxa10_b860av2.1

-

o

zte

zxa10_b860h_firmware

Vulnerable

h

zte

zxa10_b860h

-

o

zte

zxa10_b866v2-h_firmware

Vulnerable

h

zte

zxa10_b866v2-h

-

o

zte

zxa10_b866v5-w10_firmware

Vulnerable

h

zte

zxa10_b866v5-w10

-

o

zte

zxa10_b960gv1_firmware

Vulnerable

h

zte

zxa10_b960gv1

-

o

zte

zxa10_b710c-a12_firmware

Vulnerable

h

zte

zxa10_b710c-a12

-

o

zte

zxa10_b710s2-a19_firmware

Vulnerable

h

zte

zxa10_b710s2-a19

-

o

zte

zxa10_b836ct-a15_firmware

Vulnerable

h

zte

zxa10_b836ct-a15

-

o

zte

zxa10_s100v_firmware

Vulnerable

h

zte

zxa10_s100v

-

o

zte

zxa10_s200a_firmware

Vulnerable

h

zte

zxa10_s200a

-

o

zte

zxa10_s200t_firmware

Vulnerable

h

zte

zxa10_s200t

-

o

zte

zxa10_b700v7_firmware

Vulnerable

h

zte

zxa10_b700v7

-

References

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1026224

Vendor Advisory

Weaknesses

[email protected]

Primary
NVD-CWE-Other

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

9.1 · Critical

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2022-09-23T15:15:12.687

2 years ago

Last modified

2023-08-08T14:21:49.707

1 year ago