Vulnerability in N/a

CVE-2014-4019

ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to read backup files via a direct request for rom-0.

EPSS: 0.518 (98.0th percentile) — read the EPSS interpretation.

Affected products

N/a — versions n/a

References

packetstormsecurity.com/files/127129/ZTE-WXV10-W300-Disclosure-CSRF-Default.html (x_refsource_MISC)
osandamalith.wordpress.com/2014/06/15/zte-wxv10-w300-multiple-vulnerabilities/ (x_refsource_MISC)
www.exploit-db.com/exploits/33803 (x_refsource_MISC)
www.osvdb.org/102668 (x_refsource_MISC)