CVE-2018-7356 Other in ZXR10 8905E
Remote attackers can spoof connections on ZTE ZXR10 switches due to predictable TCP Initial Sequence Numbers, bypassing authentication mechanisms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7356?
CVE-2018-7356 is a medium-severity vulnerability in ZTE ZXR10 8905E, published on 1 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions up to V3.03.10.B23P2 of ZTE ZXR10 8905E product are impacted by TCP Initial Sequence Number (ISN) reuse vulnerability, which can generate easily predictable ISN, and allows remote attackers to spoof connections.
Weakness: CWE-294
Which versions are affected by CVE-2018-7356?
It affects 1 product.
Products include Zte Zxr10 8905e Firmware.
How do I fix CVE-2018-7356?
No fix has been published for CVE-2018-7356 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-7356 being exploited?
There is no known exploitation of CVE-2018-7356 in the wild and no public exploit code.
Sources
Also known as GHSA-7j79-33fw-38v7.