Vulnerabilities > ZTE
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-11-14 | CVE-2018-7358 | Improper Authentication vulnerability in ZTE Zxhn H168N Firmware ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerability, which may allow an unauthorized user to perform unauthorized operations. | 8.8 |
| 2018-11-14 | CVE-2018-7357 | Missing Authentication for Critical Function vulnerability in ZTE Zxhn H168N Firmware ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerability, which may allow an unauthorized user to gain unauthorized access. | 8.8 |
| 2018-11-01 | CVE-2018-7356 | Authentication Bypass by Capture-replay vulnerability in ZTE Zxr10 8905E Firmware 3.03.10.B23P2 All versions up to V3.03.10.B23P2 of ZTE ZXR10 8905E product are impacted by TCP Initial Sequence Number (ISN) reuse vulnerability, which can generate easily predictable ISN, and allows remote attackers to spoof connections. | 7.5 |
| 2018-09-26 | CVE-2018-7355 | Cross-site Scripting vulnerability in ZTE Mf65 Firmware and Mf65M1 Firmware All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scripting vulnerability. | 6.1 |
| 2018-07-25 | CVE-2017-10937 | SQL Injection vulnerability in ZTE Zxiptv-Ucm Firmware SQL injection vulnerability in all versions prior to V2.01.05.09 of the ZTE ZXIPTV-UCM product allows remote attackers to execute arbitrary SQL commands via the opertype parameter, resulting in the disclosure of database information. | 7.5 |
| 2018-07-25 | CVE-2017-10936 | SQL Injection vulnerability in ZTE Zxcdn-Sns Firmware SQL injection vulnerability in all versions prior to V4.01.01 of the ZTE ZXCDN-SNS product allows remote attackers to execute arbitrary SQL commands via the aoData parameter, resulting in the disclosure of database information. | 7.5 |
| 2018-07-25 | CVE-2017-10935 | Unspecified vulnerability in ZTE Zxr10 1800-2S Firmware 3.00.40 All versions prior to ZSRV2 V3.00.40 of the ZTE ZXR10 1800-2S products allow remote authenticated users to bypass the original password authentication protection to change other user's password. | 7.2 |
| 2018-07-25 | CVE-2017-10934 | Deserialization of Untrusted Data vulnerability in ZTE Zxiptv-Epg Firmware All versions prior to V5.09.02.02T4 of the ZTE ZXIPTV-EPG product use the Java RMI service in which the servers use the Apache Commons Collections (ACC) library that may result in Java deserialization vulnerabilities. | 9.8 |
| 2017-12-01 | CVE-2017-16953 | Improper Authentication vulnerability in ZTE Zxdsl 831Cii Firmware connoppp.cgi on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, which allows remote attackers to modify the PPPoE configuration or set up a malicious configuration via a GET request. | 7.5 |
| 2017-10-19 | CVE-2017-10933 | Path Traversal vulnerability in ZTE Zxdt22 Sf01 Firmware V2.06.00.00 All versions prior to V2.06.00.00 of ZTE ZXDT22 SF01, an monitoring system of ZTE energy product, are impacted by directory traversal vulnerability that allows remote attackers to read arbitrary files on the system via a full path name after host address. | 7.5 |