CVE-2017-10935

Vulnerability

The vulnerability exists in ZTE ZXR10 1800-2S products running versions prior to ZSRV2 V3.00.40. It allows remote authenticated users to bypass the original password authentication protection when changing another user's password. No special configuration is required to reach the affected code path. [1]

Exploitation

An attacker must have valid credentials to authenticate to the device remotely. Once authenticated, they can change the password of any other user without providing the current password. The attack requires no user interaction and can be performed over the network. [1]

Impact

Successful exploitation leads to unauthorized modification of other users' passwords. This can result in privilege escalation, denial of service (by locking out legitimate users), or complete compromise of the targeted accounts. The attacker gains the ability to impersonate other users and access their privileges. [1]

Mitigation

ZTE has addressed this issue in firmware version ZSRV2 V3.00.40. Users should upgrade to this version or later. The fix involves adding strict authentication functions on the server side. No workarounds are documented in the available reference. [1]