ZTE ZXV10 XT802/ET301 Permission and Access Control Vulnerability

CVE-2024-22069

Summary

A permission and access control vulnerability exists in ZTE's ZXV10 XT802 and ET301 products. This vulnerability allows an attacker with common user permissions to log into the terminal web interface and modify the administrator's password. By intercepting requests intended for password change operations, an unauthorized individual could escalate their access privileges, potentially leading to unauthorized control over network devices. Organizations using these products should assess their security measures and apply necessary updates to mitigate this risk.

References