Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-7258: ZTE ZXV10 W300 modems expose passwords via Telnet

CVE-2015-7258 · published 9 years ago

Summary

The firmware on ZTE ZXV10 W300 routers lets anyone who logs in remotely see other users' passwords through a Telnet session. This could let an attacker learn credentials and gain further access to the network. Update the device firmware to the latest version or disable Telnet access if an update is not available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
zte	zxv10_w300_firmware	w300v2.1.0f_er7_pe_o57 w300v2.1.0h_er7_pe_o57 `cpe:2.3:o:zte:zxv10_w300_firmware:w300v2.1.0f_er7_pe_o57:::::::*`

Original advisory text

ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain user passwords by displaying user information in a Telnet connection.

References

http://packetstormsecurity.com/files/134336/ZTE-ADSL-Authorization-Bypass-Inform... Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2015/Nov/48 Mailing List Third Party Advisory
http://packetstormsecurity.com/files/134493/ZTE-ADSL-ZXV10-W300-Authorization-Di... Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/38772/ Third Party Advisory VDB Entry

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Exploitation

13% chance of attack within 30 days

Type

CWE-255Credentials Management Errors

Timeline

Published24 Aug 2017

Updated20 Oct 2026

First seen29 Sep 2026

Sources

CVE-2015-7258 · NVD

Track software like this

Free during beta