CVE-2018-7359 Memory corruption in ZXHN F670

What is CVE-2018-7359?

CVE-2018-7359 is a critical memory corruption vulnerability in ZTE ZXHN F670, published on 16 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by heap-based buffer overflow vulnerability, which may allow an attacker to execute arbitrary code.

Weakness: CWE-787

Which versions are affected by CVE-2018-7359?

It affects 1 product.

Products include Zte Zxhn F670 Firmware.

How do I fix CVE-2018-7359?

No fix has been published for CVE-2018-7359 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2018-7359 being exploited?

There is no known exploitation of CVE-2018-7359 in the wild and no public exploit code.

Other vulnerabilities in ZTE ZXHN F670

• CVE-2018-7360 Information disclosure in ZXHN F670 Critical 9.6
• CVE-2019-3417 Command injection in ZXHN F670 High 8.1
• CVE-2018-7362 Missing authorization in ZXHN F670 High 7.5
• CVE-2018-7361 Null dereference in ZXHN F670 Medium 6.5
• CVE-2019-3418 Cross-site scripting in ZXHN F670 Medium 5.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4xfr-6c87-7vmj.