10
CVE-2017-10932
- EPSS 13.76%
- Veröffentlicht 28.09.2017 01:29:00
- Zuletzt bearbeitet 20.04.2025 01:37:25
- Quelle psirt@zte.com.cn
- Teams Watchlist Login
- Unerledigt Login
All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections (ACC) library that may result in Java deserialization vulnerabilities. An unauthenticated remote attacker can exploit the vulnerabilities by sending a crafted RMI request to execute arbitrary code on the target host.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zte ≫ Nr8120 Firmware Version < 12.17.20
Zte ≫ Nr8120a Firmware Version < 12.17.20
Zte ≫ Nr8150 Firmware Version < 12.17.20
Zte ≫ Nr8250 Firmware Version < 12.17.20
Zte ≫ Nr8000tr Firmware Version < 12.17.20
Zte ≫ Nr8950 Firmware Version < 12.17.20
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 13.76% | 0.937 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 10 | 10 | 10 |
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
CWE-502 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.