Details of VAR-201709-0216

ID

VAR-201709-0216

CVE

CVE-2017-10932

TITLE

ZTE Microwave NR8000 Vulnerability related to unreliable data deserialization in series products

Trust: 0.8

sources: JVNDB: JVNDB-2017-008630

DESCRIPTION

All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections (ACC) library that may result in Java deserialization vulnerabilities. An unauthenticated remote attacker can exploit the vulnerabilities by sending a crafted RMI request to execute arbitrary code on the target host. ZTE Microwave NR8000 Series products are vulnerable to unreliable data deserialization.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ZTE Microwave NR8120 and others are microwave transmission solutions of China ZTE Corporation. There are security holes in ZTE Microwave NR8000 series products. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. The following products and versions are affected: ZTE Microwave NR8120 earlier than V12.17.20; NR8120A earlier than V12.17.20; NR8120 earlier than V12.17.20; NR8150 earlier than V12.17.20; Versions earlier than TR V12.17.20; versions earlier than NR8950 V12.17.20

Trust: 2.61

sources: NVD: CVE-2017-10932 // JVNDB: JVNDB-2017-008630 // CNVD: CNVD-2017-30056 // BID: 101075 // VULHUB: VHN-101304 // VULMON: CVE-2017-10932

AFFECTED PRODUCTS

vendor:	zte	model:	nr8120	scope:	lt	version:	12.17.20	Trust: 1.8
vendor:	zte	model:	nr8120a	scope:	lt	version:	12.17.20	Trust: 1.8
vendor:	zte	model:	nr8150	scope:	lt	version:	12.17.20	Trust: 1.8
vendor:	zte	model:	nr8250	scope:	lt	version:	12.17.20	Trust: 1.8
vendor:	zte	model:	nr8950	scope:	lt	version:	12.17.20	Trust: 1.8
vendor:	zte	model:	nr8000tr	scope:	lt	version:	12.17.20	Trust: 1.0
vendor:	zte	model:	nr8000 tr	scope:	lt	version:	12.17.20	Trust: 0.8
vendor:	zte	model:	microwave nr8120	scope:	lte	version:	<=v12.17.20	Trust: 0.6
vendor:	zte	model:	nr8120a	scope:	lte	version:	<=v12.17.20	Trust: 0.6
vendor:	zte	model:	nr8120	scope:	lte	version:	<=v12.17.20	Trust: 0.6
vendor:	zte	model:	nr8150	scope:	lte	version:	<=v12.17.20	Trust: 0.6
vendor:	zte	model:	nr8250	scope:	lt	version:	v12.17.20	Trust: 0.6
vendor:	zte	model:	nr8000 tr	scope:	lt	version:	v12.17.20	Trust: 0.6
vendor:	zte	model:	nr8950	scope:	lt	version:	v12.17.20	Trust: 0.6
vendor:	zte	model:	nr8150	scope:	eq	version:	-	Trust: 0.6
vendor:	zte	model:	nr8000tr	scope:	eq	version:	-	Trust: 0.6
vendor:	zte	model:	nr8950	scope:	eq	version:	-	Trust: 0.6
vendor:	zte	model:	nr8120	scope:	eq	version:	-	Trust: 0.6
vendor:	zte	model:	nr8120a	scope:	eq	version:	-	Trust: 0.6
vendor:	zte	model:	nr8250	scope:	eq	version:	-	Trust: 0.6
vendor:	zte	model:	nr8950	scope:	eq	version:	0	Trust: 0.3
vendor:	zte	model:	nr8250	scope:	eq	version:	0	Trust: 0.3
vendor:	zte	model:	nr8150	scope:	eq	version:	0	Trust: 0.3
vendor:	zte	model:	nr8120a	scope:	eq	version:	0	Trust: 0.3
vendor:	zte	model:	nr8120	scope:	eq	version:	0	Trust: 0.3
vendor:	zte	model:	nr8000 tr	scope:	eq	version:	0	Trust: 0.3
vendor:	zte	model:	nr8950	scope:	ne	version:	12.17.20	Trust: 0.3
vendor:	zte	model:	nr8250	scope:	ne	version:	12.17.20	Trust: 0.3
vendor:	zte	model:	nr8150	scope:	ne	version:	12.17.20	Trust: 0.3
vendor:	zte	model:	nr8120a	scope:	ne	version:	12.17.20	Trust: 0.3
vendor:	zte	model:	nr8120	scope:	ne	version:	12.17.20	Trust: 0.3
vendor:	zte	model:	nr8000 tr	scope:	ne	version:	12.17.20	Trust: 0.3

sources: CNVD: CNVD-2017-30056 // BID: 101075 // JVNDB: JVNDB-2017-008630 // CNNVD: CNNVD-201709-1278 // NVD: CVE-2017-10932

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-10932
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2017-10932
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2017-30056
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201709-1278
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-101304
value:	HIGH
Trust: 0.1
VULMON:	CVE-2017-10932
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-10932
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2017-30056
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-101304
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-10932
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2017-10932
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2017-30056 // VULHUB: VHN-101304 // VULMON: CVE-2017-10932 // JVNDB: JVNDB-2017-008630 // CNNVD: CNNVD-201709-1278 // NVD: CVE-2017-10932

PROBLEMTYPE DATA

problemtype:

CWE-502

Trust: 1.9

sources: VULHUB: VHN-101304 // JVNDB: JVNDB-2017-008630 // NVD: CVE-2017-10932

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201709-1278

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201709-1278

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-008630

PATCH

title:	Remote Code Execution Vulnerability in NR8000 Series Products	url:	http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008422	Trust: 0.8
title:	Patch for ZTE Microwave NR8000 Series Remote Code Execution Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/103614	Trust: 0.6
title:	ZTE Microwave NR8000 Repair measures for series product security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=75177	Trust: 0.6
title:	Java-Deserialization-CVEs	url:	https://github.com/PalindromeLabs/Java-Deserialization-CVEs	Trust: 0.1

sources: CNVD: CNVD-2017-30056 // VULMON: CVE-2017-10932 // JVNDB: JVNDB-2017-008630 // CNNVD: CNNVD-201709-1278

EXTERNAL IDS

db:	NVD	id:	CVE-2017-10932	Trust: 3.5
db:	ZTE	id:	1008422	Trust: 2.7
db:	JVNDB	id:	JVNDB-2017-008630	Trust: 0.8
db:	CNNVD	id:	CNNVD-201709-1278	Trust: 0.7
db:	CNVD	id:	CNVD-2017-30056	Trust: 0.6
db:	BID	id:	101075	Trust: 0.5
db:	VULHUB	id:	VHN-101304	Trust: 0.1
db:	VULMON	id:	CVE-2017-10932	Trust: 0.1

sources: CNVD: CNVD-2017-30056 // VULHUB: VHN-101304 // VULMON: CVE-2017-10932 // BID: 101075 // JVNDB: JVNDB-2017-008630 // CNNVD: CNNVD-201709-1278 // NVD: CVE-2017-10932

REFERENCES

url:	http://support.zte.com.cn/support/news/loopholeinfodetail.aspx?newsid=1008422	Trust: 2.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-10932	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-10932	Trust: 0.8
url:	http://wwwen.zte.com.cn/en/	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/502.html	Trust: 0.1
url:	https://www.securityfocus.com/bid/101075	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://github.com/palindromelabs/java-deserialization-cves	Trust: 0.1

CREDITS

Zhang Jinxin

Trust: 0.3

sources: BID: 101075

SOURCES

db:	CNVD	id:	CNVD-2017-30056
db:	VULHUB	id:	VHN-101304
db:	VULMON	id:	CVE-2017-10932
db:	BID	id:	101075
db:	JVNDB	id:	JVNDB-2017-008630
db:	CNNVD	id:	CNNVD-201709-1278
db:	NVD	id:	CVE-2017-10932

LAST UPDATE DATE

2025-04-20T23:32:50.717000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-30056	date:	2017-10-14T00:00:00
db:	VULHUB	id:	VHN-101304	date:	2017-10-11T00:00:00
db:	VULMON	id:	CVE-2017-10932	date:	2017-10-11T00:00:00
db:	BID	id:	101075	date:	2017-09-15T00:00:00
db:	JVNDB	id:	JVNDB-2017-008630	date:	2017-10-25T00:00:00
db:	CNNVD	id:	CNNVD-201709-1278	date:	2017-10-09T00:00:00
db:	NVD	id:	CVE-2017-10932	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2017-30056	date:	2017-10-14T00:00:00
db:	VULHUB	id:	VHN-101304	date:	2017-09-28T00:00:00
db:	VULMON	id:	CVE-2017-10932	date:	2017-09-28T00:00:00
db:	BID	id:	101075	date:	2017-09-15T00:00:00
db:	JVNDB	id:	JVNDB-2017-008630	date:	2017-10-25T00:00:00
db:	CNNVD	id:	CNNVD-201709-1278	date:	2017-09-27T00:00:00
db:	NVD	id:	CVE-2017-10932	date:	2017-09-28T01:29:00.997