CVE-2014-8357

High

Published: 17/10/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In the web administrative portal of Zhone zNID GPON 2426A before version S3.0.501, a session key is placed in a URL, allowing remote attackers to obtain arbitrary user passwords via the sessionKey parameter in a getConfig action to backupsettings.conf.

Risk Assessment

Attackers can gain access to sensitive user passwords, potentially leading to unauthorized access to the organization's system and data.

Recommendation

It is recommended to update the software to the latest version to eliminate this vulnerability and to avoid placing session keys in URLs.

Other vulnerabilities in Zhone zNID GPON 2426A

CVE-2014-9118High
The web administrative portal in Zhone zNID GPON 2426A before version S3.0.501 is vulnerable to remote attacks that allow arbitrary command execution via shell metacharacters in the ipAddr parameter to zhnping.cmd.

Original NVD description (English source)

backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows remote attackers to obtain arbitrary user passwords via the sessionKey parameter in a getConfig action to backupsettings.conf.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS