CVE-2017-10931 json
The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulting in the ability to…
published 2017-09-19 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-2569
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 70%
- public exploits
- 0
- none known
Summary
The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users, resulting in the ability to download any files and cause information leaks such as system configuration.
Patch / fix
- zte zxr10_1800-2s_firmware 3.00.40
- zte zxr10_2800-4_firmware 3.00.40
- zte zxr10_3800-8_firmware 3.00.40
- zte zxr10_160_firmware 3.00.40
Exploit prediction
1.29% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- ZTE ZX10 1800-2S
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
support.zte.com.cn
/support/news/LoopholeInfoDetail.aspx?newsId=1008262
permissions-required
Sources
- CVE List CVE-2017-10931
- NVD CVE-2017-10931
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.