High severity · published Dec 27, 2021
CVE-2021-21751
ZTE BigVideo analysis product has an input verification vulnerability
8.1
CVSS
0.9%
EPSS
No
On KEV
Description
ZTE BigVideo analysis product has an input verification vulnerability. Due to the inconsistency between the front and back verifications when configuring the large screen page, an attacker with high privileges could exploit this vulnerability to tamper with the URL and cause service exception.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZC
Zxin10 Cms · Zte
through 3.01.01.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21751
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21751
Vendor Advisory
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1021884
More from Zxin10 Cms
7.8
CVE-2021-21750
ZTE BigVideo Analysis product has a privilege escalation vulnerability