by Kastro
Paper/Archive/CVE-2021-21741

CVE-2021-21741

zte — There is a command execution vulnerability in a ZTE conference management system.

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 80.1.801 × 2016.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

There is a command execution vulnerability in a ZTE conference management system. As some services are enabled by default, the attacker could exploit this vulnerability to execute arbitrary commands by sending specific serialization command.

Affected

ProductAffectedFixed inSource
ZXV10 M910ZXV10 M910 V1.2.21.01.04P01,ZXV10 M910 V1.2.20.01U01.01,ZXV10 M910 V1.2.19.01U01.01,ZXV10 M910 V1.2.16.01U01.01–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsupport.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1018424