Insufficient Access Control in ZTE ZXV10 W300 Router
CVE-2014-4019

7.5HIGH

Key Information:

Vendor

Zte

Status
Zxv10 W300 Firmware
Vendor
CVE Published:
20 February 2020

What is CVE-2014-4019?

The ZTE ZXV10 W300 Router, specifically with firmware version W300V1.0.0a_ZRD_LK, suffers from a vulnerability where sensitive information is stored under the web root without adequate access control. This flaw allows remote attackers to exploit the device by issuing direct requests to access backup files stored in insecure locations. As a result, sensitive data can be leaked, potentially compromising the security and privacy of users. Proper security measures and updates should be implemented to mitigate this vulnerability.

References

http://packetstormsecurity.com/files/127129/ZTE-WXV10-W30...
x_refsource_MISC
https://osandamalith.wordpress.com/2014/06/15/zte-wxv10-w...
x_refsource_MISC
http://www.exploit-db.com/exploits/33803
x_refsource_MISC

EPSS Score

59% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.