ZTE Zxdsl vulnerabilities

4 CVEs affecting ZTE Zxdsl, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-9184, published 2014-12-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-9183, published 2014-12-02. High severity, CVSS 10.0. EPSS: 3.6% chance of exploitation in the next 30 days. ZTE ZXDSL 831CII has a default password of admin for the admin account, which allows remote attackers to gain administrator privileges.
CVE-2014-9184, published 2014-12-02. Medium severity, CVSS 5.0. EPSS: 2.2% chance of exploitation in the next 30 days. ZTE ZXDSL 831CII allows remote attackers to bypass authentication via a direct request to (1) main.cgi, (2) adminpasswd.cgi, (3) userpasswd.cgi, (4) upload.cgi, (5) conprocess.cgi, or (6) connect.cgi.
CVE-2012-4746, published 2012-08-31. Medium severity, CVSS 6.8. EPSS: 1.1% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in accessaccount.cgi in ZTE ZXDSL 831IIV7.5.0a_Z29_OV allows remote attackers to hijack the authentication of administrators for requests that change…
CVE-2014-9019, published 2014-11-20. Medium severity, CVSS 6.8. EPSS: 1% chance of exploitation in the next 30 days. Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin user name…