CVE-2014-0329

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 8.5%

from disclosure to weapon5 days

Published on NVDFeb 4

1st PoC+5d

exploitation probability

8.5%top 6% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

The TELNET service on the ZTE ZXV10 W300 router 2.1.0 has a hardcoded password ending with airocon for the admin account, which allows remote attackers to obtain administrative access by leveraging knowledge of the MAC address characters present at the beginning of the password.

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/31527unverified cve_referencepacketstormsecurity.com/files/125142/ZTE-ZXV10-W300-Hardcoded-Credentials.htmlunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://blog.alguien.at/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html http://osvdb.org/102816 http://packetstormsecurity.com/files/125142/ZTE-ZXV10-W300-Hardcoded-Credentials.html https://exchange.xforce.ibmcloud.com/vulnerabilities/90958 http://www.kb.cert.org/vuls/id/228886 http://www.securityfocus.com/bid/65310