CVE-2021-21729 Cross-site request forgery in ZXHN H168N,ZXHN H108N
Attackers can perform unauthorized operations on ZTE home routers due to missing CSRF token verification, potentially altering device settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-21729?
CVE-2021-21729 is a medium-severity vulnerability in ZXHN H168N,ZXHN H108N, published on 13 Apr 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authorization operations by constructing messages.This affects: ZXHN H168N V3.5.0_EG1T5_TE, V2.5.5, ZXHN H108N V2.5.5_BTMT1
Which versions are affected by CVE-2021-21729?
It affects 2 products.
Products include Zte Zxhn H108n Firmware, Zte Zxhn H168n Firmware.
How do I fix CVE-2021-21729?
No fix has been published for CVE-2021-21729 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-21729 being exploited?
There is no known exploitation of CVE-2021-21729 in the wild and no public exploit code.
Other vulnerabilities in ZXHN H168N,ZXHN H108N
Sources
Also known as GHSA-fm5v-c286-fp3w.