CVE-2018-7358 Auth bypass in ZXHN H168N

Medium 6.5 Published 14 Nov 2018 Updated 5 Aug 2024

An improper change control vulnerability in ZTE ZXHN H168N routers allows unauthorized users to perform unauthorized operations.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-7358?

CVE-2018-7358 is a medium-severity authentication bypass vulnerability in ZTE ZXHN H168N, published on 14 Nov 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerability, which may allow an unauthorized user to perform unauthorized operations.

Weakness: CWE-287

Which versions are affected by CVE-2018-7358?

It affects 1 product.

Products include Zte Zxhn H168n Firmware.

How do I fix CVE-2018-7358?

No fix has been published for CVE-2018-7358 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-7358 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-7358 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-v355-59px-vmmr.