Lucene search

[email protected]CVE-2018-7366

HistoryDec 28, 2018 - 4:29 p.m.

CVE-2018-7366

2018-12-2816:29:06

CWE-863

[email protected]

web.nvd.nist.gov

zte

zxv10

b860av2.1

chinamobile

icnt

bestv

wasu

mgtv

authentication bypass

vulnerability

unauthorized operations

cve-2018-7366

nvd

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

6.8 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.1%

JSON

ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, the WASU versions up to V1.1.7 and the MGTV versions up to V1.4.6 have an authentication bypass vulnerability, which may allows an unauthorized user to perform unauthorized operations.

Affected configurations

NVD

Node

ztezxv10_b860av2.1_chinamobile_firmwareRange<icnt_v1.3.3

AND

ztezxv10_b860av2.1_chinamobileMatch-

Node

ztezxv10_b860av2.1_chinamobile_firmwareRange<bestv_v1.2.2

AND

ztezxv10_b860av2.1_chinamobileMatch-

Node

ztezxv10_b860av2.1_chinamobile_firmwareRange<wasu_v1.1.7

AND

ztezxv10_b860av2.1_chinamobileMatch-

Node

ztezxv10_b860av2.1_chinamobileMatch-

AND

ztezxv10_b860av2.1_chinamobile_firmwareRange<mgtv_v1.4.6

CPENameOperatorVersion
zte:zxv10_b860av2.1_chinamobile_firmwarezte zxv10 b860av2.1 chinamobile firmwarelticnt_v1.3.3

CPE	Name	Operator	Version
zte:zxv10_b860av2.1_chinamobile_firmware	zte zxv10 b860av2.1 chinamobile firmware	lt	icnt_v1.3.3

CNA Affected

[
  {
    "product": "ZXV10 B860AV2.1_ChinaMobile",
    "vendor": "ZTE",
    "versions": [
      {
        "lessThanOrEqual": "ICNT_V1.3.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "BESTV_V1.2.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "WASU_V1.1.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "MGTV_V1.4.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010023

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

6.8 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.1%

JSON

Related for CVE-2018-7366

prion1 cvelist1 nvd1