CVE-2015-7248
HighSummary
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code.
Risk Assessment
Attackers may gain access to sensitive login information, potentially leading to unauthorized access to organizational systems and data.
Recommendation
It is recommended to update devices to the latest software version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Other vulnerabilities in ZTE ZXHN H108N R1A
See all- CVE-2015-7250High
An absolute path traversal vulnerability exists in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE, allowing remote attackers to read arbitrary files via a full pathname in the getpage parameter.
- CVE-2015-7251Critical
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of 'root' for the root account, allowing remote attackers to gain administrative access via a TELNET session.
Original NVD description (English source)
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703.