Vulnerabilidades en ZTE
102 resultadosAnálisis Vexday
Com 99 CVEs catalogadas e nenhuma entrada no catálogo CISA KEV, a taxa de exploração ativa da ZTE está abaixo da média geral do catálogo, o que sugere pressão ofensiva atualmente menor do que em outros vendors. Ainda assim, o EPSS de 0,8965 registrado para CVE-2018-7358 indica probabilidade elevada de exploração para essa vulnerabilidade específica, exigindo atenção mesmo sem confirmação formal de exploração ativa. O tipo de falha mais frequente é CWE-269 (gerenciamento inadequado de privilégios), padrão que tende a favorecer escalação de privilégios e movimentação lateral em ambientes comprometidos. As 14 CVEs surgidas nos últimos 90 dias e a presença de 6 falhas críticas com 3 PoCs públicas reforçam a necessidade de monitoramento contínuo do portfólio de vulnerabilidades desse vendor.
CVE-2018-7358MEDIUMZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerabEPSS 89.6%CVE-2018-7357MEDIUMZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerabEPSS 87.9%CVE-2018-7364HIGHAll versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability. Due tEPSS 10.3%CVE-2017-3216—WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypass allowing a remoteEPSS 5.2%CVE-2017-10932—All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 EPSS 4.1%CVE-2017-10934—All versions prior to V5.09.02.02T4 of the ZTE ZXIPTV-EPG product use the Java RMI service in which the servers use the Apache Commons ColleEPSS 3.1%CVE-2019-3412CRITICALAll versions up to BD_R218V2.4 of ZTE MF920 product are impacted by command execution vulnerability. Due to some interfaces do not adequatelEPSS 2.9%CVE-2017-10933—All versions prior to V2.06.00.00 of ZTE ZXDT22 SF01, an monitoring system of ZTE energy product, are impacted by directory traversal vulnerEPSS 2.1%CVE-2019-3409CRITICALAll versions up to UKBB_WF820+_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by command injection vulnerability. Due to inadeqEPSS 1.9%CVE-2018-7355—All versions up to V1.0.0B05 of ZTE MF65 and all versions up to V1.0.0B02 of ZTE MF65M1 are impacted by cross-site scripting vulnerability. EPSS 1.9%CVE-2018-7359CRITICALAll versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by heap-based buffer overflow vulnerability, which may allow an attackEPSS 1.9%CVE-2019-3417HIGHAll versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by command injection vulnerability. Due to insufficient parameter valiEPSS 1.9%CVE-2023-25643HIGHTwo Vulnerabilities in Some ZTE Mobile Internet ProductsEPSS 1.8%CVE-2023-25649MEDIUMOS Command Injection Vulnerability in a Mobile Internet Product of ZTEEPSS 1.6%CVE-2017-10936—SQL injection vulnerability in all versions prior to V4.01.01 of the ZTE ZXCDN-SNS product allows remote attackers to execute arbitrary SQL EPSS 1.3%CVE-2017-10937—SQL injection vulnerability in all versions prior to V2.01.05.09 of the ZTE ZXIPTV-UCM product allows remote attackers to execute arbitrary EPSS 1.3%CVE-2017-10931—The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulting in the ability to EPSS 1.3%CVE-2019-3411HIGHAll versions up to BD_R218V2.4 of ZTE MF920 product are impacted by information leak vulnerability. Due to some interfaces can obtain the WeEPSS 1.3%CVE-2017-10935—All versions prior to ZSRV2 V3.00.40 of the ZTE ZXR10 1800-2S products allow remote authenticated users to bypass the original password authEPSS 1.3%CVE-2018-7362HIGHAll versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper access control vulnerability, which may allows an unauthorEPSS 1.2%