VULNERABILITY INTELLIGENCE

CVE-2015-7257

CVSS score7.5 HIGH
EPSS probability6.71%
CISA KEVNot currently listed
Published2017-08-24
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from "support" to "admin".

Weakness classification

  • CWE-640: Weak Password Recovery Mechanism for Forgotten Password

Primary references