CVE-2018-7357 : ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0

ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerability, which may allow an unauthorized user to gain unauthorized access.

Published 2018-11-14 15:29:02

Updated 2019-10-09 23:42:16

Source ZTE Corporation

View at NVD, CVE.org

Vulnerability category: Bypass

Products affected by CVE-2018-7357

ZTE » Zxhn H168n Firmware » Version: 2.2.0 Pk11t7
cpe:2.3:o:zte:zxhn_h168n_firmware:2.2.0_pk11t7:*:*:*:*:*:*:*
Matching versions
When used together with: ZTE » Zxhn H168n » Version: N/A
ZTE » Zxhn H168n Firmware » Version: 2.2.0 Pk11t
cpe:2.3:o:zte:zxhn_h168n_firmware:2.2.0_pk11t:*:*:*:*:*:*:*
Matching versions
When used together with: ZTE » Zxhn H168n » Version: N/A
ZTE » Zxhn H168n Firmware » Version: 2.2.0 Pk1.2t5
cpe:2.3:o:zte:zxhn_h168n_firmware:2.2.0_pk1.2t5:*:*:*:*:*:*:*
Matching versions
When used together with: ZTE » Zxhn H168n » Version: N/A
ZTE » Zxhn H168n Firmware » Version: 2.2.0 Pk1.2t2
cpe:2.3:o:zte:zxhn_h168n_firmware:2.2.0_pk1.2t2:*:*:*:*:*:*:*
Matching versions
When used together with: ZTE » Zxhn H168n » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2018-7357

EPSS FAQ

39.17%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-7357

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.3	LOW	AV:A/AC:L/Au:N/C:P/I:N/A:N	6.5	2.9	NIST
Access Vector: Adjacent Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
8.8	HIGH	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
6.5	MEDIUM	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	ZTE Corporation
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2018-7357

CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-7357

https://www.exploit-db.com/exploits/45972/

ZTE ZXHN H168N - Improper Access Restrictions
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009523

Security Bulletin Details
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-7357

Products affected by CVE-2018-7357

Exploit prediction scoring system (EPSS) score for CVE-2018-7357

CVSS scores for CVE-2018-7357

CWE ids for CVE-2018-7357

References for CVE-2018-7357