EDB-38773
PoCZTE ZXHN H108N R1A / ZXV10 W300 Routers - Multiple Vulnerabilities
view exploit source exploit_dbtype webappsauthor Karn Ganeshenpublished 2015-11-20catalog exploit_db
01
exploited CVEs (6)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2015-8703US | medium6.5 | Exploit | ||
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE and ZXV10 W300 devices W300V1.0.0f_ER1_PE allow remote authenticated users to bypass intended access restrictions, and d… | ||||
| CVE-2015-7252US | medium6.1 | Exploit | ||
Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to inject arbitrary web script or… | ||||
| CVE-2015-7251US | critical9.8 | Exploit | ||
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of root for the root account, which allows remote attackers to obtain administrative access vi… | ||||
| CVE-2015-7250US | high7.5 | Exploit | ||
Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to read arbitrary files via a full p… | ||||
| CVE-2015-7249US | medium4.9 | Exploit | ||
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote authenticated users to bypass intended access restrictions via a modified request, as demonstrated by lever… | ||||
| CVE-2015-7248US | high7.5 | Exploit | ||
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a diff… | ||||
scry
Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.
Free scan