📦

zxhn_h108n_r1a

Vendor: zte

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 6 Code Available
Total RCEs 0 Remote Access
Total CVEs 18 Total Indexed
Avg. EPSS 7.70% Exploit Prob.
Latest CVE CVE-2015-8703 Dec 30

Security Vulnerability Index

Page 1 / 2
6.5 CVSS
CVE-2015-8703
Exploit Found

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE and ZXV10 W300 devices W300V1.0.0f_ER1_PE allow remote authenticated users to bypass intended access restrictions, and discover credentials and keys, by reading the configuration file, a different vulnerability than CVE-2015-7248.

EPSS: 4.86%
6.1 CVSS
CVE-2015-7252
Exploit Found

Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to inject arbitrary web script or HTML via the errorpage parameter.

EPSS: 2.71%
9.8 CVSS
CVE-2015-7251
Exploit Found

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of root for the root account, which allows remote attackers to obtain administrative access via a TELNET session.

EPSS: 10.67%
7.5 CVSS
CVE-2015-7250
Exploit Found

Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.

EPSS: 15.54%
4.9 CVSS
CVE-2015-7249
Exploit Found

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote authenticated users to bypass intended access restrictions via a modified request, as demonstrated by leveraging the support account to change a password via a cgi-bin/webproc accountpsd action.

EPSS: 5.53%
7.5 CVSS
CVE-2015-7248
Exploit Found

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703.

EPSS: 6.90%