CVE-2021-21730

A ZTE product is impacted by improper access control vulnerability

published April 13, 2021

CVSS
—
EPSS
1%
Percentile
62.5
In the wild
Unconfirmed
What it is

⚠️ A sneaky access control flaw could let attackers peek behind the curtain! An improperly secured CLI on ZTE’s ZXHN H168N V3.5.0_TY.T6 is vulnerable to brute force attacks. 🔍 Think of it like a restaurant with a kitchen door that doesn’t lock — anyone can walk in and grab a bite if they keep trying the handle! In this case, the access control is the lock that’s missing its key. If an attacker manages to exploit this vulnerability, they could gain unauthorized access to the command line interface, potentially altering settings or configurations without permission. This could lead to significant disruptions in service or unauthorized changes to your network.

Put simply

Think of it like a restaurant with a kitchen door that doesn’t lock — anyone can walk in and grab a bite if they keep trying the handle! In this case, the access control is the lock that’s missing its key. This vulnerability stems from improper access controls in ZTE’s ZXHN H168N device, allowing attackers to use brute force techniques to gain CLI access.

What to do

If an attacker manages to exploit this vulnerability, they could gain unauthorized access to the command line interface, potentially altering settings or configurations without permission. This could lead to significant disruptions in service or unauthorized changes to your network. To mitigate this risk, ensure you update to the latest firmware provided by ZTE. Additionally, implement stronger password policies and monitor access logs for any suspicious activity. Regular audits of your network configuration can help catch any unauthorized changes early! You've got this! With the right steps, you can secure your devices and keep your network safe! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01002 · 62.5th percentile
Published
2021-04-13T15:08Z
EPSS history
Timeline
  • 13 APR 15:08Z
    A ZTE product is impacted by improper access control vulnerability
    cvelistv5