CVE-2015-7249

Name of the Vulnerable Software and Affected Versions ZTE ZXHN H108N R1A versions before ZTE.bhs.ZXHNH108NR1A.k PE

Description The issue allows remote authenticated users to bypass intended access restrictions via a modified request. This can be demonstrated by leveraging the support account to change a password via a "cgi-bin/webproc" accountpsd action.

Recommendations For versions before ZTE.bhs.ZXHNH108NR1A.k PE, update to ZTE.bhs.ZXHNH108NR1A.k PE or later to resolve the issue. As a temporary workaround, consider restricting access to the accountpsd action in the "cgi-bin/webproc" endpoint to minimize the risk of exploitation.