CVE Catalog
CVE-2017-16953
HighSummary
The connoppp.cgi file on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, allowing remote attackers to modify the PPPoE configuration or set up a malicious configuration via a GET request.
Risk Assessment
The lack of authentication may lead to unauthorized changes in the device configuration, posing a serious security threat to the network.
Recommendation
It is recommended to enforce authentication requirements for access to the connoppp.cgi file and to monitor and secure the PPPoE configuration.
Other vulnerabilities in ZTE ZXDSL 831CII
Original NVD description (English source)
connoppp.cgi on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, which allows remote attackers to modify the PPPoE configuration or set up a malicious configuration via a GET request.