« Volver al listado

CVE-2024-22069

Estado: AnalizadaAlta (8.8)—

There is a permission and access control vulnerability of ZTE's ZXV10 XT802/ET301 product.Attackers with common permissions can log in the terminal web and change the password of the administrator illegally by intercepting requests to change the passwords.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

ZTE — Zxv10 Et301 FirmwareZTE — Zxv10 Xt802 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-22069",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-22069",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-08T13:02:00.504571Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@zte.com.cn",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.3,
        "exploitabilityScore": 1.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@zte.com.cn",
      "affectedData": [
        {
          "vendor": "ZTE",
          "product": "ZXV10 XT802",
          "versions": [
            {
              "status": "affected",
              "version": "All versions up to V2.24.10P1",
              "lessThan": "V2.24.10P1",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "ZTE",
          "product": "ZXV10 ET301",
          "versions": [
            {
              "status": "affected",
              "version": "All versions up to V3.22.11P3",
              "lessThan": "V3.22.11P3",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:zte:zxv10_et301_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "zte",
          "product": "zxv10_et301_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "v3.22.11p3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:o:zte:zxv10_xt802_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "zte",
          "product": "zxv10_xt802_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "v2.24.10p1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-08-08T08:15:05.123",
  "references": [
    {
      "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1036424",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@zte.com.cn"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@zte.com.cn",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is a permission and access control vulnerability of ZTE's ZXV10 XT802/ET301 product.Attackers with common permissions can log in the terminal web and change the password of the administrator illegally by intercepting requests to change the passwords."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de permiso y control de acceso del producto ZXV10 XT802/ET301 de ZTE. Los atacantes con permisos comunes pueden iniciar sesión en la web del terminal y cambiar la contraseña del administrador ilegalmente interceptando solicitudes para cambiar las contraseñas."
    }
  ],
  "lastModified": "2026-06-17T07:10:39.163",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zte:zxv10_et301_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "186C3F1A-7F78-49C0-90E6-2BE0F886476B",
              "versionEndExcluding": "v3.22.11p3"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zte:zxv10_et301:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "0DEBA407-CA72-4047-AF67-04714058C326"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:zte:zxv10_xt802_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3DD663A2-181C-40C4-920D-D81719C6195F",
              "versionEndExcluding": "v2.24.10p1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:zte:zxv10_xt802:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "CF753B8F-BEAC-4095-8E7A-526A9B89049F"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@zte.com.cn"
}