CVE-2014-4154: ZTE ZXV10 w300

Medium severity, CVSS 5.0. EPSS: 6.6% chance of exploitation in the next 30 days.

ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the PPPoE/PPPoA password via a direct request for basic/tc2wanfun.js.

Affected products

• ZTE ZXV10 w300
• ZTE ZXV10 w300 Firmware: version 1.0.0a_zrd_lk only

Published 2014-07-16. Last modified 2026-06-17.