CVE-2015-7250
HighSummary
An absolute path traversal vulnerability exists in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE, allowing remote attackers to read arbitrary files via a full pathname in the getpage parameter.
Risk Assessment
This vulnerability may lead to the disclosure of sensitive information from the system, posing a serious threat to the organization's data security.
Recommendation
It is recommended to update the devices to the latest firmware version to eliminate this vulnerability and to monitor system access for potential attack attempts.
Other vulnerabilities in ZTE ZXHN H108N R1A
See all- CVE-2015-7248High
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code.
- CVE-2015-7251Critical
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of 'root' for the root account, allowing remote attackers to gain administrative access via a TELNET session.
Original NVD description (English source)
Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.