Deserialization in ZTE Nr8000 Series
CVE-2017-10932
All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections (ACC) library that may result in Java deserialization vulnerabilities. An unauthenticated remote attacker can exploit the vulnerabilities by sending a crafted RMI request to execute arbitrary code on the target host.
Vulnerability class: Insecure Deserialization
EPSS: 0.041 (89.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Zte Nr8000 Series — versions All versions prior to V12.17.20
- Zte Nr8000tr
- Zte Nr8000tr_firmware
- Zte Nr8120
- Zte Nr8120a
- Zte Nr8120a_firmware
- Zte Nr8120_firmware
- Zte Nr8150
- Zte Nr8150_firmware
- Zte Nr8250
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@zte.com.cn (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-10932?
- CVE-2017-10932 is a critical-severity vulnerability in ZTE Nr8000 Series, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2017-09-28.
- How severe is CVE-2017-10932?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2017-10932 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.