by Kastro
Paper/Archive/CVE-2022-39070

CVE-2022-39070

zte — There is an access control vulnerability in some ZTE PON OLT products.

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 59.7.597 × 2011.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

There is an access control vulnerability in some ZTE PON OLT products. Due to improper access control settings, remote attackers could use the vulnerability to log in to the device and execute any operation.

Affected

ProductAffectedFixed inSource
ZXA10 C3XXAll versions up to V2.1.0 XGP002.3–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsupport.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1027824