CVE-2021-21726

Name of the Vulnerable Software and Affected Versions ZTE ZXONE 9700 versions V1.40.021.021CP049 ZTE ZXONE 8700 versions V1.40.021.021CP049 ZTE ZXONE 19700 versions V1.40.021.021CP049 ZTE ZXONE 9700 versions V1.0P02B219 @NCPM-RELEASE 2.40R1-20200914.set ZTE ZXONE 8700 versions V1.0P02B219 @NCPM-RELEASE 2.40R1-20200914.set ZTE ZXONE 19700 versions V1.0P02B219 @NCPM-RELEASE 2.40R1-20200914.set

Description The issue is related to an input verification vulnerability in the diagnostic function interface of some ZTE products. Due to insufficient verification of some parameters input by users, an attacker with high privileges can cause a process exception by repeatedly inputting illegal parameters.

Recommendations For ZTE ZXONE 9700 version V1.40.021.021CP049, update to a version that includes proper input verification for the diagnostic function interface. For ZTE ZXONE 8700 version V1.40.021.021CP049, update to a version that includes proper input verification for the diagnostic function interface. For ZTE ZXONE 19700 version V1.40.021.021CP049, update to a version that includes proper input verification for the diagnostic function interface. For ZTE ZXONE 9700 version V1.0P02B219 @NCPM-RELEASE 2.40R1-20200914.set, update to a version that includes proper input verification for the diagnostic function interface. For ZTE ZXONE 8700 version V1.0P02B219 @NCPM-RELEASE 2.40R1-20200914.set, update to a version that includes proper input verification for the diagnostic function interface. For ZTE ZXONE 19700 version V1.0P02B219 @NCPM-RELEASE 2.40R1-20200914.set, update to a version that includes proper input verification for the diagnostic function interface. As a temporary workaround, consider restricting access to the diagnostic function interface until a patch is available.