ZTE
Page 2 of 3 — ZTE CVEs from a corpus of 206, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-21741 | Critical | 9.8 | 2021-08-30 | There is a command execution vulnerability in a ZTE conference management system. As some services are enabled by default, the attacker could exploit this vuln… |
CVE-2021-21740 | Low | 2.4 | 2021-08-09 | There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product. The attacker could insert the USB disk with… |
CVE-2021-21739 | Medium | 4.6 | 2021-08-05 | A ZTE's product of the transport network access layer has a security vulnerability. Because the system does not sufficiently verify the data reliability, attac… |
CVE-2021-21738 | Medium | 6.1 | 2021-08-05 | ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities. Due to insufficient input verification, the attacker could imp… |
CVE-2021-21737 | High | 7.5 | 2021-06-24 | A smart STB product of ZTE is impacted by a permission and access control vulnerability. Due to insufficient protection of system application, attackers could… |
CVE-2021-21736 | High | 7.2 | 2021-06-10 | A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end ap… |
CVE-2021-21735 | Medium | 6.5 | 2021-06-10 | A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could exploit this vulnera… |
CVE-2021-21734 | Medium | 6.5 | 2021-05-28 | Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command. This affects: ZTE PON… |
CVE-2021-21733 | Medium | 4.9 | 2021-05-19 | The management system of ZXCDN is impacted by the information leak vulnerability. Attackers can make further analysis according to the information returned by… |
CVE-2021-21732 | High | 7.5 | 2021-05-19 | A mobile phone of ZTE is impacted by improper access control vulnerability. Due to improper permission settings, third-party applications can read some files i… |
CVE-2021-21731 | High | 8.1 | 2021-04-13 | A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management page does not fully verify whether the r… |
CVE-2021-21730 | Critical | 9.8 | 2021-04-13 | A ZTE product is impacted by improper access control vulnerability. The attacker could exploit this vulnerability to access CLI by brute force attacks.This aff… |
CVE-2021-21729 | Medium | 6.5 | 2021-04-13 | Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authorization operations by… |
CVE-2021-21728 | Medium | 5.3 | 2021-04-09 | A ZTE product has a configuration error vulnerability. Because a certain port is open by default, an attacker can consume system processing resources by flushi… |
CVE-2021-21727 | High | 7.5 | 2021-03-29 | A ZTE product has a DoS vulnerability. A remote attacker can amplify traffic by sending carefully constructed IPv6 packets to the affected devices, which event… |
CVE-2021-21726 | Low | 2.3 | 2021-03-12 | Some ZTE products have an input verification vulnerability in the diagnostic function interface. Due to insufficient verification of some parameters input by u… |
CVE-2021-21725 | Medium | 5.7 | 2021-03-05 | A ZTE product has an information leak vulnerability. An attacker with higher authority can go beyond their authority to access files in other directories by pe… |
CVE-2021-21724 | Medium | 4.4 | 2021-02-26 | A ZTE product has a memory leak vulnerability. Due to the product's improper handling of memory release in certain scenarios, a local attacker with device perm… |
CVE-2021-21723 | High | 7.5 | 2021-01-26 | Some ZTE products have a DoS vulnerability. Due to the improper handling of memory release in some specific scenarios, a remote attacker can trigger the vulner… |
CVE-2021-21722 | Medium | 4.4 | 2021-01-14 | A ZTE Smart STB is impacted by an information leak vulnerability. The device did not fully verify the log, so attackers could use this vulnerability to obtain… |
CVE-2020-6882 | High | 7.5 | 2020-12-21 | ZTE E8810/E8820/E8822 series routers have an information leak vulnerability, which is caused by hard-coded MQTT service access credentials on the device. The r… |
CVE-2020-6881 | High | 7.5 | 2020-12-21 | ZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability, which is caused by the failure of the device to verify the validity of abnormal messages… |
CVE-2020-6880 | Critical | 9.8 | 2020-12-01 | A ZXELINK wireless controller has a SQL injection vulnerability. A remote attacker does not need to log in. By sending malicious SQL statements, because the de… |
CVE-2020-6879 | Low | 3.5 | 2020-11-19 | Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of t… |
CVE-2020-6877 | High | 8.8 | 2020-11-05 | A ZTE product is impacted by an information leak vulnerability. An attacker could use this vulnerability to obtain the authentication password of the handheld… |
CVE-2020-6876 | Medium | 5.4 | 2020-10-26 | A ZTE product is impacted by an XSS vulnerability. The vulnerability is caused by the lack of correct verification of client data in the WEB module. By inserti… |
CVE-2020-6875 | Critical | 9.8 | 2020-10-05 | A ZTE product is impacted by the improper access control vulnerability. Due to lack of an authentication protection mechanism in the program, attackers could u… |
CVE-2020-6874 | Critical | 9.1 | 2020-09-01 | A ZTE product is impacted by the cryptographic issues vulnerability. The encryption algorithm is not properly used, so remote attackers could use this vulnerab… |
CVE-2020-6873 | Medium | 5.3 | 2020-09-01 | A ZTE product has a DoS vulnerability. Because the equipment couldn’t distinguish the attack packets and normal packets with valid http links, the remote attac… |
CVE-2020-6872 | Medium | 6.1 | 2020-07-20 | The server management software module of ZTE has a storage XSS vulnerability. The attacker inserts some attack codes through the foreground login page, which w… |
CVE-2020-6871 | Critical | 9.8 | 2020-07-20 | The server management software module of ZTE has an authentication issue vulnerability, which allows users to skip the authentication of the server and execute… |
CVE-2020-6870 | High | 8.0 | 2020-06-24 | The version V12.17.20T115 of ZTE U31R20 product is impacted by a design error vulnerability. An attacker could exploit the vulnerability to log in to the FTP s… |
CVE-2020-6869 | High | 8.1 | 2020-06-17 | All versions up to 10.06 of ZTEMarket APK are impacted by an information leak vulnerability. Due to Activity Component exposure users can exploit this vulnerab… |
CVE-2020-12695 | High | 7.5 | 2020-06-08 | The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a differe… |
CVE-2020-6868 | Medium | 6.5 | 2020-06-01 | There is an input validation vulnerability in a PON terminal product of ZTE, which supports the creation of WAN connections through WEB management pages. The f… |
CVE-2020-6867 | Medium | 5.5 | 2020-04-30 | ZTE's SDON controller is impacted by the resource management error vulnerability. When RPC is frequently called by other applications in the case of mass traff… |
CVE-2020-6866 | Medium | 4.9 | 2020-04-30 | A ZTE product is impacted by a resource management error vulnerability. An attacker could exploit this vulnerability to cause a denial of service by issuing a… |
CVE-2020-6865 | Medium | 6.5 | 2020-04-30 | ZTE SDN controller platform is impacted by an information leakage vulnerability. Due to the program's failure to optimize the response of failure to the reques… |
CVE-2020-6864 | Medium | 6.5 | 2020-02-27 | ZTE E8820V3 router product is impacted by an information leak vulnerability. Attackers could use this vulnerability to to gain wireless passwords. After obtain… |
CVE-2020-6863 | Medium | 6.5 | 2020-02-27 | ZTE E8820V3 router product is impacted by a permission and access control vulnerability. Attackers could use this vulnerability to tamper with DDNS parameters… |
CVE-2014-4019 | High | 7.5 | 2020-02-20 | ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote at… |
CVE-2020-6862 | Medium | 5.3 | 2020-01-17 | V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by Information leak vulnerability. Unauthorized users could log in directly to obtain page informatio… |
CVE-2019-3431 | Critical | 9.8 | 2019-12-23 | All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems vulnerability. Attackers could sniff unencrypted account and pass… |
CVE-2019-3430 | Medium | 4.9 | 2019-12-23 | All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have an information disclosure vulnerability. Attackers could use this vulnerability to co… |
CVE-2019-3429 | Medium | 5.3 | 2019-12-23 | All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have a file reading vulnerability. Attackers could obtain log file information without aut… |
CVE-2019-3428 | Medium | 6.5 | 2019-11-22 | The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a configuration error vulnerability. An attacker could directly access the management portal… |
CVE-2019-3427 | High | 7.2 | 2019-11-22 | The version V6.01.03.01 of ZTE ZXCDN IAMWEB product is impacted by a code injection vulnerability. An attacker could exploit the vulnerability to inject malici… |
CVE-2019-3420 | Medium | 6.5 | 2019-11-13 | All versions up to V2.5.0_EG1T5_TED of ZTE ZXHN H108N product are impacted by an information leak vulnerability. An attacker could exploit the vulnerability to… |
CVE-2019-3426 | High | 8.8 | 2019-11-08 | The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by the input validation vulnerability. An attacker could exploit t… |
CVE-2019-3425 | High | 8.8 | 2019-11-08 | The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by vulnerability of permission and access control. An attacker cou… |
CVE-2019-3422 | Medium | 6.2 | 2019-11-07 | The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related p… |
CVE-2019-3419 | Medium | 5.7 | 2019-10-31 | A security vulnerability exists in a management port in the version of ZTE's ZXMP M721V3.10P01B10_M2NCP. An attacker could exploit this vulnerability to build… |
CVE-2019-3416 | Critical | 9.8 | 2019-09-23 | All versions up to V81511329.1008 of ZTE ZXV10 B860A products are impacted by input validation vulnerability. Due to input validation, unauthorized users can t… |
CVE-2019-3418 | Medium | 5.4 | 2019-08-15 | All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by cross-site scripting vulnerability (XSS). Due to incomplete input validation, an autho… |
CVE-2019-3417 | High | 8.8 | 2019-08-15 | All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by command injection vulnerability. Due to insufficient parameter validation check, an au… |
CVE-2019-3414 | Medium | 4.8 | 2019-07-22 | All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain th… |
CVE-2019-3415 | Medium | 5.7 | 2019-07-11 | ZTE MW NR8000V2.4.4.03 and NR8000V2.4.4.04 are impacted by path traversal vulnerability. Due to path traversal,users can download any files. |
CVE-2019-3413 | Medium | 5.4 | 2019-06-11 | All versions up to V20.18.40.R7.B1of ZTE NetNumen DAP product have an XSS vulnerability. Due to the lack of correct validation of client data in WEB applicatio… |
CVE-2019-3412 | Critical | 9.8 | 2019-06-11 | All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by command execution vulnerability. Due to some interfaces do not adequately verify parameters… |
CVE-2019-3411 | High | 7.5 | 2019-06-11 | All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by information leak vulnerability. Due to some interfaces can obtain the WebUI login password… |
CVE-2019-3410 | Medium | 4.6 | 2019-06-11 | All versions up to UKBB_WF820+_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,which stems from the fac… |
CVE-2019-3409 | Critical | 9.0 | 2019-06-11 | All versions up to UKBB_WF820+_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by command injection vulnerability. Due to inadequate parameter veri… |
CVE-2018-7366 | Medium | 4.3 | 2018-12-28 | ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, the WASU versions up to V1.1.7 and the MGT… |
CVE-2018-7365 | Medium | 5.1 | 2018-12-20 | All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerability, which may allow an unauthorized use… |
CVE-2018-7364 | Critical | 9.8 | 2018-12-07 | All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability. Due to improper access c… |
CVE-2018-7363 | Medium | 4.3 | 2018-11-16 | All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper authorization vulnerability. Since appviahttp service has no authorization de… |
CVE-2018-7362 | High | 7.5 | 2018-11-16 | All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper access control vulnerability, which may allows an unauthorized user to perfor… |
CVE-2018-7361 | Medium | 6.5 | 2018-11-16 | All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by null pointer dereference vulnerability, which may allows an attacker to cause a denial… |
CVE-2018-7360 | Critical | 9.6 | 2018-11-16 | All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by information exposure vulnerability, which may allow an unauthenticated attacker to get… |
CVE-2018-7359 | Critical | 9.0 | 2018-11-16 | All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by heap-based buffer overflow vulnerability, which may allow an attacker to execute arbit… |
CVE-2018-7358 | Medium | 6.5 | 2018-11-14 | ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerability, which may al… |
CVE-2018-7357 | Medium | 6.5 | 2018-11-14 | ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerability, which may al… |
CVE-2018-7356 | Medium | 5.6 | 2018-11-01 | All versions up to V3.03.10.B23P2 of ZTE ZXR10 8905E product are impacted by TCP Initial Sequence Number (ISN) reuse vulnerability, which can generate easily p… |
CVE-2018-7355 | Medium | 6.1 | 2018-09-26 | All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scripting vulnerability. Due to improper neu… |
CVE-2017-10937 | High | 7.5 | 2018-07-25 | SQL injection vulnerability in all versions prior to V2.01.05.09 of the ZTE ZXIPTV-UCM product allows remote attackers to execute arbitrary SQL commands via th… |
CVE-2017-10936 | High | 7.5 | 2018-07-25 | SQL injection vulnerability in all versions prior to V4.01.01 of the ZTE ZXCDN-SNS product allows remote attackers to execute arbitrary SQL commands via the ao… |
CVE-2017-10935 | High | 7.2 | 2018-07-25 | All versions prior to ZSRV2 V3.00.40 of the ZTE ZXR10 1800-2S products allow remote authenticated users to bypass the original password authentication protecti… |
CVE-2017-10934 | Critical | 9.8 | 2018-07-25 | All versions prior to V5.09.02.02T4 of the ZTE ZXIPTV-EPG product use the Java RMI service in which the servers use the Apache Commons Collections (ACC) librar… |
CVE-2017-16953 | High | 7.5 | 2017-12-01 | connoppp.cgi on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, which allows remote attackers to modify the PPPoE configuration or set up… |
CVE-2017-10933 | High | 7.5 | 2017-10-19 | All versions prior to V2.06.00.00 of ZTE ZXDT22 SF01, an monitoring system of ZTE energy product, are impacted by directory traversal vulnerability that allows… |
CVE-2017-10932 | Critical | 9.8 | 2017-09-28 | All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the application… |
CVE-2017-10931 | High | 7.5 | 2017-09-19 | The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulting in the ability to download any files… |
CVE-2017-10930 | Critical | 9.8 | 2017-09-19 | The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in ordinary users being able to download con… |
CVE-2015-7255 | High | 7.5 | 2017-08-29 | ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host keys, which might allo… |
CVE-2015-7259 | High | 8.8 | 2017-08-24 | ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid username and password pairs, which allo… |
CVE-2015-7258 | High | 8.8 | 2017-08-24 | ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain user passwords by displaying user infor… |
CVE-2015-7257 | High | 7.5 | 2017-08-24 | ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change the admin password by… |
CVE-2017-3216 | Critical | 9.8 | 2017-06-20 | WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remote, unauthenticated a… |
CVE-2015-8703 | Medium | 6.5 | 2015-12-30 | ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE and ZXV10 W300 devices W300V1.0.0f_ER1_PE allow remote authenticated users to bypass intended acces… |
CVE-2015-7252 | Medium | 6.1 | 2015-12-30 | Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to inject ar… |
CVE-2015-7251 | Critical | 9.8 | 2015-12-30 | ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of root for the root account, which allows remote attackers to obtain adm… |
CVE-2015-7250 | High | 7.5 | 2015-12-30 | Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to read arbitra… |
CVE-2015-7249 | Medium | 4.9 | 2015-12-30 | ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote authenticated users to bypass intended access restrictions via a modified request, as… |
CVE-2015-7248 | High | 7.5 | 2015-12-30 | ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTM… |
CVE-2014-9184 | | 2014-12-02 | ZTE ZXDSL 831CII allows remote attackers to bypass authentication via a direct request to (1) main.cgi, (2) adminpasswd.cgi, (3) userpasswd.cgi, (4) upload.cgi… | |
CVE-2014-9183 | | 2014-12-02 | ZTE ZXDSL 831CII has a default password of admin for the admin account, which allows remote attackers to gain administrator privileges. | |
CVE-2014-9020 | | 2014-11-20 | Cross-site scripting (XSS) vulnerability in the Quick Stats page (psilan.cgi) in ZTE ZXDSL 831 and 831CII allows remote attackers to inject arbitrary web scrip… | |
CVE-2014-9019 | | 2014-11-20 | Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of administrators for reques… | |
CVE-2014-8493 | | 2014-11-20 | ZTE ZXHN H108L with firmware 4.0.0d_ZRQ_GR4 allows remote attackers to modify the CWMP configuration via a crafted request to Forms/access_cwmp_1. | |
CVE-2014-4154 | | 2014-07-16 | ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote at… |