Vulnerability Details : CVE-2015-7255
ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host keys, which might allow remote attackers to obtain credentials or other sensitive information via a man-in-the-middle attack, passive decryption attack, or impersonating a legitimate device.
Vulnerability category: Information leak
Exploit prediction scoring system (EPSS) score for CVE-2015-7255
Probability of exploitation activity in the next 30 days: 0.14%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 49 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2015-7255
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2015-7255
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-7255
-
http://www.kb.cert.org/vuls/id/566724
VU#566724 - Embedded devices use non-unique X.509 certificates and SSH host keysMitigation;Third Party Advisory;US Government Resource
-
https://www.kb.cert.org/vuls/id/BLUU-A2NQYR
VU#566724 - Embedded devices use non-unique X.509 certificates and SSH host keysThird Party Advisory;US Government Resource
-
https://github.com/sec-consult/houseofkeys/search?p=3&q=zte&type=&utf8=%E2%9C%93
Search · zte · GitHubThird Party Advisory
Products affected by CVE-2015-7255
- cpe:2.3:o:zte:ox-330p_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:zte:zxhn_h108n_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:zte:w300v1.0.0s_zrd_tr1_d68_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:zte:hg110_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:zte:gan9.8t101a-b_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:zte:mf28g_firmware:-:*:*:*:*:*:*:*