Critical severity · published Dec 23, 2019
CVE-2019-3431
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems vulnerability
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems vulnerability. Attackers could sniff unencrypted account and password through the network for front-end system access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZG
Zxcloud Goldendata Vap · Zte
through zxivs-vap-portal-xzgav4.01.01.02 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3431
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3431
Vendor Advisory
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012023
More from Zxcloud Goldendata Vap
5.3
CVE-2019-3429
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have a file reading vulnerability
4.9
CVE-2019-3430
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have an information disclosure vulnerability