Unscored severity · published Feb 4, 2014
CVE-2014-0329
The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account, which allows remote attackers to obtain administrative…
–
CVSS
8.5%
EPSS
No
On KEV
Description
The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account, which allows remote attackers to obtain administrative access by leveraging knowledge of the MAC address characters present at the beginning of the password.
Exploitation
Is it being used?
Exploit prediction (EPSS)8.5% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZW
Zxv10 W300 · Zte
2.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0329
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0329
blog.alguien.at
http://blog.alguien.at/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html
osvdb.org
http://osvdb.org/102816
packetstormsecurity.com
http://packetstormsecurity.com/files/125142/ZTE-ZXV10-W300-Hardcoded-Credentials.html
US Government Resource
http://www.kb.cert.org/vuls/id/228886
www.securityfocus.com
http://www.securityfocus.com/bid/65310
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/90958
More from Zxv10 W300
–
CVE-2014-4154
ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain…
–
CVE-2014-4018
The ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via…
–
CVE-2014-4155
Cross-site request forgery (CSRF) vulnerability in the ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK allows remote attackers to hijack the authentication of…