High severity · published Sep 19, 2017
CVE-2017-10931
The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulting in the ability to download any files and cause…
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulting in the ability to download any files and cause information leaks such as system configuration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
Z1
Zxr10 160 Firmware · Zte
before 3.00.40 · source: NVD
Z1
Zxr10 1800-2s Firmware · Zte
before 3.00.40 · source: NVD
Z2
Zxr10 2800-4 Firmware · Zte
before 3.00.40 · source: NVD
Z3
Zxr10 3800-8 Firmware · Zte
before 3.00.40 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-10931
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-10931
Permissions Required
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008262
More from Zxr10 160 Firmware
9.8
CVE-2017-10930
The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in ordinary users being able to download configuration files to…
6.5
CVE-2024-22066
There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router
6.5
CVE-2024-22068
Improper Privilege Management vulnerability in ZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series on 64 bit allows Functionality Bypass.This issue affects ZXR10…