ZTE ZXV10 w300 vulnerabilities

5 CVEs affecting ZTE ZXV10 w300, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-12695, published 2020-06-08.

More from ZTE.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-12695, published 2020-06-08. High severity, CVSS 7.5. EPSS: 15.2% chance of exploitation in the next 30 days. The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully…
• CVE-2014-0329, published 2014-02-04. High severity, CVSS 9.3. EPSS: 8.5% chance of exploitation in the next 30 days. The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account, which allows remote attackers to obtain administrative access by leveraging…
• CVE-2014-4154, published 2014-07-16. Medium severity, CVSS 5.0. EPSS: 6.6% chance of exploitation in the next 30 days. ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the PPPoE/PPPoA…
• CVE-2014-4018, published 2014-07-16. High severity, CVSS 7.8. EPSS: 6.3% chance of exploitation in the next 30 days. The ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via unspecified vectors.
• CVE-2014-4155, published 2014-06-19. Medium severity, CVSS 6.8. EPSS: 2.3% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in the ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK allows remote attackers to hijack the authentication of administrators for requests that…