CVE-2018-7363

Vulnerability

The improper authorization vulnerability affects all versions up to V1.1.10P3T18 of the ZTE ZXHN F670 V1.0 product. The appviahttp service lacks any authorization delay, which allows an attacker to repeatedly attempt authentication without throttling [1].

Exploitation

An attacker needs network access to the device (adjacent network, CVSS 3.0 vector AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No authentication is required. The attacker can brute force account credentials by sending multiple login requests to the appviahttp service without encountering any delay or lockout mechanism [1].

Impact

Successful exploitation results in limited information disclosure (confidentiality impact: low). The attacker can obtain valid credentials, potentially gaining unauthorized access to the device's administrative functions [1].

Mitigation

ZTE has released the fix in version V1.1.10P3T22 for ZXHN F670 V1.0. Users should upgrade their firmware to this version or later. If upgrading is not immediately possible, restrict network access to the device's management interface [1].