CVE-2017-10935 - OpenCVE

All versions prior to ZSRV2 V3.00.40 of the ZTE ZXR10 1800-2S products allow remote authenticated users to bypass the original password authentication protection to change other user's password.

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:S/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Zte	Zxr10 1800-2s Zxr10 1800-2s Firmware

Configuration 1 [-]

AND

cpe:2.3:o:zte:zxr10_1800-2s_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:zte:zxr10_1800-2s:-:*:*:*:*:*:*:*

References

Link	Resource
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008723	Mitigation Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: zte

Published: 2017-11-22T00:00:00

Updated: 2018-07-25T14:57:01

Reserved: 2017-07-05T00:00:00

Link: CVE-2017-10935

JSON object: View

NVD Information

Status : Analyzed

Published: 2018-07-25T15:29:00.263

Modified: 2019-10-03T00:03:26.223

Link: CVE-2017-10935

JSON object: View

Redhat Information

No data.

CWE

NVD-CWE-noinfo

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:zte:zxr10_1800-2s_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "720817E2-2A6C-458D-A755-734D3950ACB3", "versionEndExcluding": "3.00.40", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:zte:zxr10_1800-2s:-:*:*:*:*:*:*:*", "matchCriteriaId": "CA2AC22D-CC1C-4F6E-AFA1-EEC6C2A294DC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "All versions prior to ZSRV2 V3.00.40 of the ZTE ZXR10 1800-2S products allow remote authenticated users to bypass the original password authentication protection to change other user's password."}, {"lang": "es", "value": "Todas las versiones anteriores a ZSRV2 V3.00.40 de los productos ZTE ZXR10 1800-2S permiten que usuarios autenticados remotos omitan la protecci\u00f3n de autenticaci\u00f3n por contrase\u00f1a original para cambiar las contrase\u00f1as de otros usuarios."}], "id": "CVE-2017-10935", "lastModified": "2019-10-03T00:03:26.223", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-07-25T15:29:00.263", "references": [{"source": "psirt@zte.com.cn", "tags": ["Mitigation", "Vendor Advisory"], "url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008723"}], "sourceIdentifier": "psirt@zte.com.cn", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}