CVE-2018-7364

All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability. Due to improper access control to devcomm process, an unauthorized remote attacker can exploit this vulnerability to execute arbitrary code with root privileges.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
zteCNA
8.3 HIGH
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVEADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 91%
Common Weakness Enumeration
References
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009943
https://github.com/orangecertcc/security-research/security/advisories/GHSA-34f2-7h57-rg7p
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009943
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009943
https://github.com/orangecertcc/security-research/security/advisories/GHSA-34f2-7h57-rg7p
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009943