CVE-2018-7364

All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability. Due to improper access control to devcomm process, an unauthorized remote attacker can exploit this vulnerability to execute arbitrary code with root privileges.

Affected

ZTE · ZXIN10-European region

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0 ZTE

8.3 HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

10.29% chance of exploitation in the next 30 days, 96th percentile

Published

2018-12-07

Updated

2024-08-05

Proof-of-concept exploits (1)

• orangecertcc/security-research/security/advisories/GHSA-34f2-7h57-rg7p

Security advisories

• http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009943
• https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009943

References

• CVE Record
• NVD entry