ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote…
Priority MEDIUM 42CWE-640Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-640.
Summary
ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change the admin password by intercepting an outgoing password change request, and changing the username parameter from "support" to "admin".
Why it matters now
EPSS 0.0671 93rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:zte:zxv10_w300_firmware:w300v2.1.0f_er7_pe_o57:*:*:*:*:*:*:* | w300v2.1.0f_er7_pe_o57 | Vulnerable | ZTE |
| cpe:2.3:h:zte:zxv10_w300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ZTE |
| cpe:2.3:o:zte:zxv10_w300_firmware:w300v2.1.0h_er7_pe_o57:*:*:*:*:*:*:* | w300v2.1.0h_er7_pe_o57 | Vulnerable | ZTE |
- cpe:2.3:o:zte:zxv10_w300_firmware:w300v2.1.0f_er7_pe_o57:*:*:*:*:*:*:* Versions w300v2.1.0f_er7_pe_o57 Vulnerable ·ZTE
- cpe:2.3:h:zte:zxv10_w300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ZTE
- cpe:2.3:o:zte:zxv10_w300_firmware:w300v2.1.0h_er7_pe_o57:*:*:*:*:*:*:* Versions w300v2.1.0h_er7_pe_o57 Vulnerable ·ZTE
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2015-7257
- 2026-10-03 Alias added: GHSA-748x-222r-qc52
References
More ZTE Zxv10 W300 Firmware vulnerabilities
- TI-2015-06030 ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote… CVSS 3.0HIGH 8.8
- TI-2015-06031 ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user… CVSS 3.0HIGH 8.8
- TI-2014-03278 ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under… CVSS 3.1HIGH 7.5
- TI-2014-03277 The ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK has a default password of… CVSS 2.0HIGH 7.8
- TI-2015-07154 ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE and ZXV10 W300 devices… CVSS 3.0MEDIUM 6.5
- TI-2014-03394 Cross-site request forgery (CSRF) vulnerability in the ZTE ZXV10 W300 router with… CVSS 2.0MEDIUM 6.8
Sources
- CVE-2015-7257 · CVE Program
- CVE-2015-7257 · NVD
- FIRST EPSS
- GHSA-748x-222r-qc52 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences