// For flags

CVE-2017-10932

 

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections (ACC) library that may result in Java deserialization vulnerabilities. An unauthenticated remote attacker can exploit the vulnerabilities by sending a crafted RMI request to execute arbitrary code on the target host.

Todas las versiones anteriores a V12.17.20 de los productos de ZTE Microwave de la serie NR8000 (NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR y NR8950) son las aplicaciones de arquitectura C/S que emplean el servicio Java RMI mediante el cual los servidores emplean la biblioteca Apache Commons Collections (ACC), lo que puede originar vulnerabilidades de deserialización de Java. Un atacante remoto sin autenticar puede explotar estas vulnerabilidades enviando una petición RMI manipulada para ejecutar código arbitrario en el host objetivo.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-07-05 CVE Reserved
  • 2017-09-27 CVE Published
  • 2024-05-28 EPSS Updated
  • 2024-09-16 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-502: Deserialization of Untrusted Data
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Zte
Search vendor "Zte"
 Nr8120 Firmware
Search vendor "Zte" for product "Nr8120 Firmware"
--
Affected
in Zte
Search vendor "Zte"
 Nr8120
Search vendor "Zte" for product "Nr8120"
--
Safe
Zte
Search vendor "Zte"
 Nr8120a Firmware
Search vendor "Zte" for product "Nr8120a Firmware"
--
Affected
in Zte
Search vendor "Zte"
 Nr8120a
Search vendor "Zte" for product "Nr8120a"
--
Safe
Zte
Search vendor "Zte"
 Nr8150 Firmware
Search vendor "Zte" for product "Nr8150 Firmware"
--
Affected
in Zte
Search vendor "Zte"
 Nr8150
Search vendor "Zte" for product "Nr8150"
--
Safe
Zte
Search vendor "Zte"
 Nr8250 Firmware
Search vendor "Zte" for product "Nr8250 Firmware"
--
Affected
in Zte
Search vendor "Zte"
 Nr8250
Search vendor "Zte" for product "Nr8250"
--
Safe
Zte
Search vendor "Zte"
 Nr8000tr Firmware
Search vendor "Zte" for product "Nr8000tr Firmware"
--
Affected
in Zte
Search vendor "Zte"
 Nr8000tr
Search vendor "Zte" for product "Nr8000tr"
--
Safe
Zte
Search vendor "Zte"
 Nr8950 Firmware
Search vendor "Zte" for product "Nr8950 Firmware"
--
Affected
in Zte
Search vendor "Zte"
 Nr8950
Search vendor "Zte" for product "Nr8950"
--
Safe