CVE-2015-7255 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host keys, which might allow remote attackers to obtain credentials or other sensitive information via a man-in-the-middle attack, passive decryption attack, or impersonating a legitimate device.

CVSS Score

7.5

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Zte	Ox-330P Firmware	-
Zte	Ox-330P	-
Zte	Zxhn H108N Firmware	-
Zte	Zxhn H108N	-
Zte	W300V1.0.0S Zrd Tr1 D68 Firmware	-
Zte	W300V1.0.0S Zrd Tr1 D68	-
Zte	Hg110 Firmware	-
Zte	Hg110	-
Zte	Gan9.8T101A-B Firmware	-
Zte	Gan9.8T101A-B	-
Zte	Mf28G Firmware	-
Zte	Mf28G	-

Related Weaknesses (CWE)

CWE-200

References

http://www.kb.cert.org/vuls/id/566724MitigationThird Party AdvisoryUS Government Resource
https://github.com/sec-consult/houseofkeys/search?p=3&q=zte&type=&utf8=%E2%9C%93Third Party Advisory
https://www.kb.cert.org/vuls/id/BLUU-A2NQYRThird Party AdvisoryUS Government Resource
http://www.kb.cert.org/vuls/id/566724MitigationThird Party AdvisoryUS Government Resource
https://github.com/sec-consult/houseofkeys/search?p=3&q=zte&type=&utf8=%E2%9C%93Third Party Advisory
https://www.kb.cert.org/vuls/id/BLUU-A2NQYRThird Party AdvisoryUS Government Resource

FAQ

What is CVE-2015-7255?

CVE-2015-7255 is a vulnerability with a CVSS score of 7.5 (HIGH). ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host keys, which might allow remote attackers to obtain credentials ...

How severe is CVE-2015-7255?

CVE-2015-7255 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2015-7255?

Check the references section above for vendor advisories and patch information. Affected products include: Zte Ox-330P Firmware, Zte Ox-330P, Zte Zxhn H108N Firmware, Zte Zxhn H108N, Zte W300V1.0.0S Zrd Tr1 D68 Firmware.