VULNERABILITY INTELLIGENCE

CVE-2018-7364

CVSS score9.8 CRITICAL

EPSS probability10.29%

CISA KEVNot currently listed

Published2018-12-07

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability. Due to improper access control to devcomm process, an unauthorized remote attacker can exploit this vulnerability to execute arbitrary code with root privileges.

Weakness classification

CWE-284: Improper Access Control

Primary references

psirt@zte.com.cn — Vendor Advisory
psirt@zte.com.cn — Exploit, Third Party Advisory
psirt@zte.com.cn — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory