cbcvebase.
CVE-2015-7259
published 2017-08-24

CVE-2015-7259: ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid username and password pairs, which…

PriorityP265high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
9.46%
94.8th percentile
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid username and password pairs, which allows remote authenticated users to login to a target account via any of its username and password pairs.

Affected

2 ranges
VendorProductVersion rangeFixed in
ztezxv10_w300_firmware——
ztezxv10_w300_firmware——

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://<host>/password.htm↗
commandADSL#login show↗
  • →Monitor for HTTP requests to /password.htm where the 'username' parameter value differs from the authenticated session user (e.g., non-admin user submitting username=admin), indicating privilege escalation attempt (CVE-2015-7257). ↗
  • →Detect Telnet login attempts to ZTE ZXV10 W300 devices followed by execution of 'login show' command, which dumps all usernames and cleartext passwords. ↗
  • →Flag authentication events where the same account (e.g., 'admin') is successfully logged into using different credential pairs — indicative of CVE-2015-7259 multiple valid username/password pairs. ↗
  • →Prioritize detection on devices identified as ZTE ADSL ZXV10 W300 firmware versions W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57, with large deployment noted in Peru (TdP ISP). ↗
  • ·The vulnerability affects only the two specific firmware versions listed; other W300 firmware versions are not confirmed affected. ↗
  • ·Telnet is enabled on affected devices and exposes cleartext credentials via the 'login show' command; Telnet access should be blocked at the network perimeter for these devices. ↗

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.