CVE-2018-7364

All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability. Due to improper access control to devcomm process, an unauthorized remote attacker can exploit this vulnerability to execute arbitrary code with root privileges.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0

8.3 HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

10.29% chance of exploitation in the next 30 days, 95th percentile

Published

2018-12-07

Updated

2024-08-05

Proof-of-concept exploits (1)

• orangecertcc/security-research/security/advisories/GHSA-34f2-7h57-rg7p

References

• CVE Record
• NVD entry

Related

• CVE-2019-17570
• CVE-2020-3264
• CVE-2021-0252
• CVE-2021-0253
• CVE-2021-1382
• CVE-2021-1383