CVE-2022-39070 : There is an access control vulnerability in some ZTE PON OLT products. Due to im

There is an access control vulnerability in some ZTE PON OLT products. Due to improper access control settings, remote attackers could use the vulnerability to log in to the device and execute any operation.

Published 2022-11-22 17:15:11

Updated 2022-11-28 19:29:32

Source ZTE Corporation

View at NVD, CVE.org

Products affected by CVE-2022-39070

ZTE » Zxa10 C300m Firmware
Versions from including (>=) 2.1.0 and before (<) 2.1.0xgp002.4
cpe:2.3:o:zte:zxa10_c300m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: ZTE » Zxa10 C300m » Version: N/A
ZTE » Zxa10 C350m Firmware
Versions from including (>=) 2.1.0 and before (<) 2.1.0xgp002.4
cpe:2.3:o:zte:zxa10_c350m_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: ZTE » Zxa10 C350m » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-39070

EPSS FAQ

0.41%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 74 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-39070

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2022-39070

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1027824

Security Bulletin Details
Vendor Advisory

Jump to

Vulnerability Details : CVE-2022-39070

Products affected by CVE-2022-39070

Exploit prediction scoring system (EPSS) score for CVE-2022-39070

CVSS scores for CVE-2022-39070

References for CVE-2022-39070