CVE-2017-10931

EUVD-2017-2569
The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulting in the ability to download any files and cause information leaks such as system configuration.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 60%
Affected Products (NVD)
VendorProductVersion
ztezxr10_1800-2s_firmware
𝑥
< 3.00.40
ztezxr10_2800-4_firmware
𝑥
< 3.00.40
ztezxr10_3800-8_firmware
𝑥
< 3.00.40
ztezxr10_160_firmware
𝑥
< 3.00.40
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008262
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008262