10

CVE-2017-10932

All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections (ACC) library that may result in Java deserialization vulnerabilities. An unauthenticated remote attacker can exploit the vulnerabilities by sending a crafted RMI request to execute arbitrary code on the target host.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zte ≫ Nr8120 Firmware Version < 12.17.20
   Zte ≫ Nr8120 Version -
Zte ≫ Nr8120a Firmware Version < 12.17.20
   Zte ≫ Nr8120a Version -
Zte ≫ Nr8150 Firmware Version < 12.17.20
   Zte ≫ Nr8150 Version -
Zte ≫ Nr8250 Firmware Version < 12.17.20
   Zte ≫ Nr8250 Version -
Zte ≫ Nr8000tr Firmware Version < 12.17.20
   Zte ≫ Nr8000tr Version -
Zte ≫ Nr8950 Firmware Version < 12.17.20
   Zte ≫ Nr8950 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.14% 0.895
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008422
Vendor Advisory