1. Home
  2. CVE Database
  3. CVE-2017-10934
CRITICAL · 9.8

CVE-2017-10934

All versions prior to V5.09.02.02T4 of the ZTE ZXIPTV-EPG product use the Java RMI service in which the servers use the Apache Commons Collections (ACC) library that may result in Java deserialization...

Vulnerability Description

All versions prior to V5.09.02.02T4 of the ZTE ZXIPTV-EPG product use the Java RMI service in which the servers use the Apache Commons Collections (ACC) library that may result in Java deserialization vulnerabilities. An unauthenticated remote attacker can exploit the vulnerabilities by sending a crafted RMI request to execute arbitrary code on the target host.

CVSS Score

9.8

CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
ZteZxiptv-Epg Firmware< 5.09.02.02t4
ZteZxiptv-Epg-

Related Weaknesses (CWE)

CWE-502

References

FAQ

What is CVE-2017-10934?

CVE-2017-10934 is a vulnerability with a CVSS score of 9.8 (CRITICAL). All versions prior to V5.09.02.02T4 of the ZTE ZXIPTV-EPG product use the Java RMI service in which the servers use the Apache Commons Collections (ACC) library that may result in Java deserialization...

How severe is CVE-2017-10934?

CVE-2017-10934 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2017-10934?

Check the references section above for vendor advisories and patch information. Affected products include: Zte Zxiptv-Epg Firmware, Zte Zxiptv-Epg.