Details of VAR-202406-0749

ID

VAR-202406-0749

CVE

CVE-2023-25646

TITLE

ZTE ZXHN H388X Unauthorized Access Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2024-28501

DESCRIPTION

There is an unauthorized access vulnerability in ZTE H388X. If H388X is caused by brute-force serial port cracking,attackers with common user permissions can use this vulnerability to obtain elevated permissions on the affected device by performing specific operations. ZTE ZXHN H388X is a router produced by ZTE

Trust: 1.44

sources: NVD: CVE-2023-25646 // CNVD: CNVD-2024-28501

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2024-28501

AFFECTED PRODUCTS

vendor:

zte

model:

zxhn h388x

scope:

version:

Trust: 0.6

sources: CNVD: CNVD-2024-28501

CVSS

SEVERITY

CVSSV2

CVSSV3

psirt@zte.com.cn:	CVE-2023-25646
value:	HIGH
Trust: 1.0
CNVD:	CNVD-2024-28501
value:	MEDIUM
Trust: 0.6

CNVD:	CNVD-2024-28501
severity:	MEDIUM
baseScore:	6.8
vectorString:	AV:A/AC:H/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.2
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

psirt@zte.com.cn:	CVE-2023-25646
baseSeverity:	HIGH
baseScore:	7.1
vectorString:	CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector:	PHYSICAL
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.5
impactScore:	6.0
version:	3.1
Trust: 1.0

sources: CNVD: CNVD-2024-28501 // NVD: CVE-2023-25646

PROBLEMTYPE DATA

problemtype:

CWE-281

Trust: 1.0

sources: NVD: CVE-2023-25646

PATCH

title:

Patch for ZTE ZXHN H388X Unauthorized Access Vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/557036

Trust: 0.6

sources: CNVD: CNVD-2024-28501

EXTERNAL IDS

db:	NVD	id:	CVE-2023-25646	Trust: 1.6
db:	ZTE	id:	1035844	Trust: 1.0
db:	CNVD	id:	CNVD-2024-28501	Trust: 0.6

sources: CNVD: CNVD-2024-28501 // NVD: CVE-2023-25646

REFERENCES

url:	https://support.zte.com.cn/support/news/loopholeinfodetail.aspx?newsid=1035844	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2023-25646	Trust: 0.6

sources: CNVD: CNVD-2024-28501 // NVD: CVE-2023-25646

SOURCES

db:	CNVD	id:	CNVD-2024-28501
db:	NVD	id:	CVE-2023-25646

LAST UPDATE DATE

2024-08-14T14:48:26.605000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2024-28501	date:	2024-06-21T00:00:00
db:	NVD	id:	CVE-2023-25646	date:	2024-06-20T12:43:25.663

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2024-28501	date:	2024-06-21T00:00:00
db:	NVD	id:	CVE-2023-25646	date:	2024-06-20T07:15:41.340