4.3med
CVE-2018-7366
ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, the WASU versions up t…
Published 7 y ago · modified 4 mo ago · JSON
CVSS
4.3
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 48%
Public exploits
0
none known
Summary
ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, the WASU versions up to V1.1.7 and the MGTV versions up to V1.4.6 have an authentication bypass vulnerability, which may allows an unauthorized user to perform unauthorized operations.
Exploit prediction (EPSS)
0.58% probability of exploitation in the next 30 days, higher than 48% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 4.3 | CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 4.3 | CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.0 | 6.8 | CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- ZTE ZXV10 B860AV2.1_ChinaMobile
Classification
- Weakness
- CWE-863 Incorrect Authorization
References
- support.zte.com.cn /support/news/LoopholeInfoDetail.aspx?newsId=1010023 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-7366
- NVD: CVE-2018-7366
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.