📦

zxv10_w300

Vendor: zte

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 10 Code Available
Total RCEs 0 Remote Access
Total CVEs 72 Total Indexed
Avg. EPSS 8.51% Exploit Prob.
Latest CVE CVE-2020-12695 Jun 08

Security Vulnerability Index

Page 1 / 8
7.5 CVSS
CVE-2020-12695
Exploit Found

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.

EPSS: 15.19%
7.5 CVSS
CVE-2014-4019
Exploit Found

ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to read backup files via a direct request for rom-0.

EPSS: 12.37%
8.8 CVSS
CVE-2015-7259
Exploit Found

ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid username and password pairs, which allows remote authenticated users to login to a target account via any of its username and password pairs.

EPSS: 9.46%
8.8 CVSS
CVE-2015-7258
Exploit Found

ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain user passwords by displaying user information in a Telnet connection.

EPSS: 12.89%
7.5 CVSS
CVE-2015-7257
Exploit Found

ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from "support" to "admin".

EPSS: 6.71%
6.5 CVSS
CVE-2015-8703
Exploit Found

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE and ZXV10 W300 devices W300V1.0.0f_ER1_PE allow remote authenticated users to bypass intended access restrictions, and discover credentials and keys, by reading the configuration file, a different vulnerability than CVE-2015-7248.

EPSS: 4.86%
5.0 CVSS
CVE-2014-4154
Exploit Found

ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the PPPoE/PPPoA password via a direct request for basic/tc2wanfun.js.

EPSS: 6.57%
7.8 CVSS
CVE-2014-4018
Exploit Found

The ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via unspecified vectors.

EPSS: 6.30%
6.8 CVSS
CVE-2014-4155
Exploit Found

Cross-site request forgery (CSRF) vulnerability in the ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a request to Forms/tools_admin_1.

EPSS: 2.27%
9.3 CVSS
CVE-2014-0329
Exploit Found

The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account, which allows remote attackers to obtain administrative access by leveraging knowledge of the MAC address characters present at the beginning of the password.

EPSS: 8.52%