« Volver al listado

CVE-2021-21740

Estado: ModificadaBaja (2.4)—

There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product. The attacker could insert the USB disk with the symbolic link into the residential gateway, and access unauthorized directory information through the symbolic link, causing information leak.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

ZTE — Zxhn H2640 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-21740",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 2.4,
          "attackVector": "PHYSICAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@zte.com.cn",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "ZXHN H2640",
          "versions": [
            {
              "status": "affected",
              "version": "V10.0.0C6_TY"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-08-09T16:15:07.037",
  "references": [
    {
      "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1017244",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@zte.com.cn"
    },
    {
      "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1017244",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product. The attacker could insert the USB disk with the symbolic link into the residential gateway, and access unauthorized directory information through the symbolic link, causing information leak."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de filtrado de información en el reproductor multimedia digital (DMS) del producto de puerta de enlace residencial de ZTE. El atacante podría insertar el disco USB con el enlace simbólico en el gateway residencial y acceder a información de directorio no autorizada mediante el enlace simbólico, causando un filtrado de información"
    }
  ],
  "lastModified": "2026-06-17T03:36:04.270",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zte:zxhn_h2640_firmware:10.0.0c6_ty:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC47AFC2-3F09-43A5-8E36-7C751180CE82"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zte:zxhn_h2640:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B4451A86-1BF1-4B10-9A5A-0D532C9F5F9B"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@zte.com.cn"
}