Sign-up

ID

VAR-201708-0145


CVE

CVE-2015-7258


TITLE

ZTE ADSL ZXV10 W300 Vulnerability related to certificate / password management in modem

Trust: 0.8

sources: JVNDB: JVNDB-2015-007786

DESCRIPTION

ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain user passwords by displaying user information in a Telnet connection. ZTE ADSL ZXV10 W300 Modems contain vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ZTEADSLZXV10W300 is an ADSL modem (Modem) product from China ZTE Corporation (ZTE). A security vulnerability exists in the ZTEADSLZXV10W300W300V2.1.0f_ER7_PE_O57 version and the W300V2.1.0h_ER7_PE_O57 version. There are security vulnerabilities in ZTE ADSL ZXV10 W300 W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57. Other functions may be vulnerable as well. *Expected behavior:* Only administrative 'admin' user should be able to change password for all the device users. 'support' is a diagnostic user with restricted privileges. It can change only its own password. *Steps to reproduce:* a. Login as user 'support' password XXX b. Access Password Change page - http://<IP>/password.htm c. Submit request d. Intercept and Tamper the parameter ­ username ­ change from 'support' to 'admin' e. *CVE-ID*: CVE-2015-7258 *Steps to reproduce:* $ telnet <IP> Trying <IP>... Connected to <IP>. Escape character is '^]'. User Access Verification Username: admin Password: <­­­ admin/XXX1 $sh ADSL#login show <--­­­ shows user information Username Password Priority admin password1 2 support password2 0 admin password3 1 3 *(Potential) Backdoor account feature - **insecure account management* Same login account can exist on the device, multiple times, each with different priority#. It is possible to log in to device with either of the username/password combination. *CVE-ID*: CVE-2015-7259 It is considered as a (redundant) login support *feature*. *Steps to reproduce:* $ telnet <IP> Trying <IP>... Connected to <IP>. Escape character is '^]'. User Access Verification User Access Verification Username: admin Password: <­--­­ admin/password3 $sh ADSL#login show Username Password Priority admin password1 2 support password2 0 admin password3 1 +++++ Best Regards, Karn Ganeshen -- Best Regards, Karn Ganeshen

Trust: 2.34

sources: NVD: CVE-2015-7258 // JVNDB: JVNDB-2015-007786 // CNVD: CNVD-2017-28178 // VULHUB: VHN-85219 // PACKETSTORM: 134336

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2017-28178

AFFECTED PRODUCTS

vendor:ztemodel:zxv10 w300scope:eqversion:w300v2.1.0f_er7_pe_o57

Trust: 2.4

vendor:ztemodel:zxv10 w300scope:eqversion:w300v2.1.0h_er7_pe_o57

Trust: 2.4

vendor:ztemodel:adsl zxv10 w300 w300v2.1.0f er7 pe o57scope: - version: -

Trust: 0.6

vendor:ztemodel:adsl zxv10 w300 w300v2.1.0h er7 pe o57scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2017-28178 // JVNDB: JVNDB-2015-007786 // CNNVD: CNNVD-201708-1098 // NVD: CVE-2015-7258

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-7258
value: HIGH

Trust: 1.0

NVD: CVE-2015-7258
value: HIGH

Trust: 0.8

CNVD: CNVD-2017-28178
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201708-1098
value: CRITICAL

Trust: 0.6

VULHUB: VHN-85219
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-7258
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-28178
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-85219
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2015-7258
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2017-28178 // VULHUB: VHN-85219 // JVNDB: JVNDB-2015-007786 // CNNVD: CNNVD-201708-1098 // NVD: CVE-2015-7258

PROBLEMTYPE DATA

problemtype:CWE-255

Trust: 1.9

sources: VULHUB: VHN-85219 // JVNDB: JVNDB-2015-007786 // NVD: CVE-2015-7258

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201708-1098

TYPE

trust management

Trust: 0.6

sources: CNNVD: CNNVD-201708-1098

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-007786

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-85219

PATCH
title:Top Pageurl:http://www.zte.co.jp/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2015-007786

EXTERNAL IDS
db:NVDid:CVE-2015-7258
Trust: 3.2
db:PACKETSTORMid:134336
Trust: 2.6
db:PACKETSTORMid:134493
Trust: 2.5
db:EXPLOIT-DBid:38772
Trust: 2.3
db:JVNDBid:JVNDB-2015-007786
Trust: 0.8
db:CNNVDid:CNNVD-201708-1098
Trust: 0.7
db:CNVDid:CNVD-2017-28178
Trust: 0.6
db:VULHUBid:VHN-85219
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-28178 // 
            
            
            
            VULHUB: VHN-85219 // 
            
            
            
            JVNDB: JVNDB-2015-007786 // 
            
            
            
            PACKETSTORM: 134336 // 
            
            
            
            CNNVD: CNNVD-201708-1098 // 
            
            
            
            NVD: CVE-2015-7258

REFERENCES
url:http://packetstormsecurity.com/files/134336/zte-adsl-authorization-bypass-information-disclosure.html
Trust: 2.5
url:http://packetstormsecurity.com/files/134493/zte-adsl-zxv10-w300-authorization-disclosure-backdoor.html
Trust: 2.5
url:https://www.exploit-db.com/exploits/38772/
Trust: 2.3
url:http://seclists.org/fulldisclosure/2015/nov/48
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2015-7258
Trust: 1.5
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7258
Trust: 0.8
url:http://<ip>/password.htm
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-7259
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-7257
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-28178 // 
            
            
            
            VULHUB: VHN-85219 // 
            
            
            
            JVNDB: JVNDB-2015-007786 // 
            
            
            
            PACKETSTORM: 134336 // 
            
            
            
            CNNVD: CNNVD-201708-1098 // 
            
            
            
            NVD: CVE-2015-7258

CREDITS
Karn Ganeshen
Trust: 0.1
sources:
            
            
            PACKETSTORM: 134336

SOURCES
db:CNVDid:CNVD-2017-28178
db:VULHUBid:VHN-85219
db:JVNDBid:JVNDB-2015-007786
db:PACKETSTORMid:134336
db:CNNVDid:CNNVD-201708-1098
db:NVDid:CVE-2015-7258

LAST UPDATE DATE
2025-04-20T23:27:21.775000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-28178date:2017-09-26T00:00:00
db:VULHUBid:VHN-85219date:2017-08-30T00:00:00
db:JVNDBid:JVNDB-2015-007786date:2017-09-20T00:00:00
db:CNNVDid:CNNVD-201708-1098date:2017-08-25T00:00:00
db:NVDid:CVE-2015-7258date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:CNVDid:CNVD-2017-28178date:2017-09-26T00:00:00
db:VULHUBid:VHN-85219date:2017-08-24T00:00:00
db:JVNDBid:JVNDB-2015-007786date:2017-09-20T00:00:00
db:PACKETSTORMid:134336date:2015-11-14T13:33:33
db:CNNVDid:CNNVD-201708-1098date:2017-08-25T00:00:00
db:NVDid:CVE-2015-7258date:2017-08-24T20:29:00.440