CVE-2015-7251
CriticalSummary
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of 'root' for the root account, allowing remote attackers to gain administrative access via a TELNET session.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized access to the system, posing a serious threat to the security of data and organizational infrastructure.
Recommendation
It is recommended to update the devices to the latest firmware version to remove the hardcoded password and to disable TELNET access.
Other vulnerabilities in ZTE ZXHN H108N R1A
See all- CVE-2015-7250High
An absolute path traversal vulnerability exists in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE, allowing remote attackers to read arbitrary files via a full pathname in the getpage parameter.
- CVE-2015-7248High
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code.
Original NVD description (English source)
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of root for the root account, which allows remote attackers to obtain administrative access via a TELNET session.