CVE-2021-21723 Denial of service in <ZXR10 9904, ZXR10 9908, ZXR10 9916, ZXR10 9904-S, ZXR10 9908-S>
Remote attackers can cause a denial of service on ZTE ZXR10 switches by triggering a memory leak through specific operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21723?
CVE-2021-21723 is a high-severity denial of service vulnerability in <ZXR10 9904, ZXR10 9908, ZXR10 9916, ZXR10 9904-S, ZXR10 9908-S>, published on 21 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Some ZTE products have a DoS vulnerability. Due to the improper handling of memory release in some specific scenarios, a remote attacker can trigger the vulnerability by performing a series of operations, resulting in memory leak, which may eventually lead to device denial of service. This affects: ZXR10 9904, ZXR10 9908, ZXR10 9916, ZXR10 9904-S, ZXR10 9908-S; all versions up to V1.01.10.B12.
Weakness: CWE-401
Which versions are affected by CVE-2021-21723?
It affects 5 products.
Products include Zte Zxr10 9904-S Firmware, Zte Zxr10 9904 Firmware, Zte Zxr10 9908-S Firmware, Zte Zxr10 9908 Firmware, Zte Zxr10 9916 Firmware.
How do I fix CVE-2021-21723?
No fix has been published for CVE-2021-21723 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-21723 being exploited?
There is no known exploitation of CVE-2021-21723 in the wild and no public exploit code.
Sources
Also known as GHSA-7h22-x3wx-hv9p.