CVE-2021-21736 Missing authorization in ZXHN HS562
Users with revoked sharing permissions can still control the camera, allowing unauthorized actions like restarting or resetting the device.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21736?
CVE-2021-21736 is a high-severity missing authorization vulnerability in ZXHN HS562, published on 10 Jun 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end app, users whose sharing permissions have been revoked can still control the camera, such as restarting the camera, restoring factory settings, etc.. This affects ZXHN HS562 V1.0.0.0B2.0000, V1.0.0.0B3.0000E
Weakness: CWE-276
Which versions are affected by CVE-2021-21736?
It affects 1 product.
Products include Zte Zxhn Hs562 Firmware.
How do I fix CVE-2021-21736?
No fix has been published for CVE-2021-21736 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-21736 being exploited?
There is no known exploitation of CVE-2021-21736 in the wild and no public exploit code.
Sources
Also known as GHSA-j56v-m9w9-5r65.