cbcvebase.
CVE-2015-7257
published 2017-08-24

CVE-2015-7257: ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change the admin password by…

PriorityP357high7.5CVSS 3.0
AVNACHPRLUINSUCHIHAH
EXPLOIT
EPSS
6.71%
93.1th percentile
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from "support" to "admin".

Affected

2 ranges
VendorProductVersion rangeFixed in
ztezxv10_w300_firmware——
ztezxv10_w300_firmware——

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://<host>/password.htm↗
commandADSL#login show↗
  • →Intercept HTTP password change requests and inspect the 'username' parameter — a non-admin user (e.g., 'support') manipulating this field to 'admin' indicates exploitation of CVE-2015-7257. ↗
  • →Monitor for password change submissions where the username parameter value is 'admin' but the authenticated session belongs to a non-admin user such as 'support'. ↗
  • →Alert on Telnet sessions to ZTE ZXV10 W300 devices where the command 'login show' is issued, as it exposes all usernames and cleartext passwords (CVE-2015-7258). ↗
  • →Flag HTTP POST requests to /password.htm on ZTE ZXV10 W300 devices where the old password field is absent but a new password is submitted — the exploit notes the old password is not requested. ↗
  • ·Affected firmware versions are W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 only; detection rules should be scoped to these specific ZTE ZXV10 W300 modem firmware versions. ↗
  • ·These devices are reported to have large deployment primarily in Peru (used by TdP — Telefónica del Perú), which may help scope threat hunting geographically. ↗
  • ·The vulnerability requires the attacker to already be authenticated as a non-admin user (e.g., 'support'); unauthenticated exploitation is not described for CVE-2015-7257. ↗

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.08.5HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.