Privilege escalation in ZTE Zxv10 Et301
CVE-2024-22069
There is a permission and access control vulnerability of ZTE's ZXV10 XT802/ET301 product.Attackers with common permissions can log in the terminal web and change the password of the administrator illegally by intercepting requests to change the passwords.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L.
EPSS exploit prediction
EPSS: 0.003 (16.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 16th percentile — 16.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- ZTE Zxv10 Et301 — versions All versions up to V3.22.11P3
- ZTE Zxv10 Et301
- ZTE Zxv10 Et301 Firmware
- ZTE Zxv10 Xt802 — versions All versions up to V2.24.10P1
- ZTE Zxv10 Xt802
- ZTE Zxv10 Xt802 Firmware
Weakness classification (CWE)
References
- support.zte.com.cn/support/news/LoopholeInfoDetail.aspx (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-22069?
- CVE-2024-22069 is a high-severity vulnerability in ZTE Zxv10 Et301, classified under Improper Privilege Management. CVSS score: 7.1/10. Published 2024-08-08.
- How severe is CVE-2024-22069?
- High severity. CVSS v3 base score is 7.1 out of 10.