// For flags

CVE-2014-0329

ZTE ZXV10 W300 Router - Hard-Coded Credentials

Severity Score

9.3
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account, which allows remote attackers to obtain administrative access by leveraging knowledge of the MAC address characters present at the beginning of the password.

El servicio TELNET del router ZTE ZXV10 W300 2.1.0 tiene una contraseña embebida terminada en aircon para la cuenta admin que permite a atacantes remotos obtener acceso administrativo conociendo los carateres de la dirección MAC presentes en el comienzo de la contraseña.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2013-12-05 CVE Reserved
  • 2014-02-04 CVE Published
  • 2014-02-09 First Exploit
  • 2024-08-06 CVE Updated
  • 2024-08-22 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-255: Credentials Management Errors
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Zte
Search vendor "Zte"
 Zxv10 W300
Search vendor "Zte" for product "Zxv10 W300"
 2.1.0
Search vendor "Zte" for product "Zxv10 W300" and version "2.1.0"
-
Affected