CVE-2021-47741CWE-522

ZBL EPON ONU Broadband Router V100R001 Privilege Escalation via Configuration Endpoint

High · published December 31, 2025

CVSS v4.0
8.7
EPSS
0%
Percentile
20.1
In the wild
Unconfirmed
What it is

⚡ Limited access can lead to a big breach! A sneaky request to the wrong endpoint lets low-level users elevate their privileges and access the super user password! 🔥 Think of it like a restaurant where the busboy has found a way to sneak into the manager's office — suddenly, they can change the menu, give themselves a raise, or even make themselves the head chef! 🍽️ If attackers exploit this vulnerability, they could elevate their access and gain control over sensitive functionalities, compromising the entire network. This could lead to unauthorized changes, data breaches, or even complete network takeover — all because of a simple request!

Put simply

Think of it like a restaurant where the busboy has found a way to sneak into the manager's office — suddenly, they can change the menu, give themselves a raise, or even make themselves the head chef! 🍽️ This privilege escalation vulnerability in the ZBL EPON ONU Broadband Router V100R001 allows limited administrative users to send crafted requests to configuration endpoints, exposing super user credentials and enabling unauthorized access to privileged features.

What to do

If attackers exploit this vulnerability, they could elevate their access and gain control over sensitive functionalities, compromising the entire network. This could lead to unauthorized changes, data breaches, or even complete network takeover — all because of a simple request! To protect against this, immediately patch your router with the latest firmware update from the manufacturer. Additionally, review access controls to limit who can send requests to sensitive endpoints and regularly monitor logs for suspicious activity. You've got this! Follow these steps, and you'll be well on your way to locking down your network! 🛡️

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00287 · 20.1th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2025-12-31T18:39Z
EPSS history
Timeline
  • 31 DEC 18:39Z
    ZBL EPON ONU Broadband Router V100R001 Privilege Escalation via Configuration Endpoint
    cvelistv5