CVE-2018-7364 Missing authorization in ZXIN10-European region
An unauthorized remote attacker can exploit improper access control in the devcomm process to execute arbitrary code with root privileges on ZTE ZXIN10 devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-7364?
CVE-2018-7364 is a high-severity missing authorization vulnerability in ZTE ZXIN10-European region, published on 7 Dec 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability. Due to improper access control to devcomm process, an unauthorized remote attacker can exploit this vulnerability to execute arbitrary code with root privileges.
Weakness: CWE-284
Which versions are affected by CVE-2018-7364?
It affects 1 product.
Products include Zte Zxin10.
How do I fix CVE-2018-7364?
No fix has been published for CVE-2018-7364 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-7364 being exploited?
There is no known exploitation of CVE-2018-7364 in the wild and no public exploit code.
Sources
Also known as GHSA-m37h-p77w-f6f7.