8.3high
CVE-2018-7364in critical feed
All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability.
Published 7 y ago · modified 4 mo ago · JSON
CVSS
8.3
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
10.3%
percentile 96%
Public exploits
0
none known
Summary
All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability. Due to improper access control to devcomm process, an unauthorized remote attacker can exploit this vulnerability to execute arbitrary code with root privileges.
Exploit prediction (EPSS)
10.29% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 8.3 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.0 | 8.3 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- ZTE ZXIN10-European region
Classification
- Weakness
- CWE-284 Improper Access Control
References
- support.zte.com.cn /support/news/LoopholeInfoDetail.aspx?newsId=1009943 · x_transferred
- support.zte.com.cn /support/news/LoopholeInfoDetail.aspx?newsId=1009943 · x_transferred
- github.com /orangecertcc/security-research/security/advisories/GHSA-34f2-7h57-rg7p · x_transferred
Sources
- CVE List: CVE-2018-7364
- NVD: CVE-2018-7364
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.