TI-2018-05337 Aliases CVE-2018-7361 GHSA-vq42-379v-g652

NULL pointer dereference in ZTE ZXHN F670

LOW 30CWE-476Published 2018-11-16 · Updated 2024-08-05

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by null pointer dereference vulnerability, which may allows an attacker to cause a denial of service via appviahttp service.

Why it matters now

EPSS 0.00824 57th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ZTE	ZXHN F670	up to V1.1.10P3T18	—	No fix listed	CNA

ZXHN F670 VendorZTE Affected up to V1.1.10P3T18 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:zte:zxhn_f670_firmware::::::::	up to 1.1.10p3t18	Vulnerable	ZTE
cpe:2.3:h:zte:zxhn_f670:-:::::::*	not specified by NVD	Running on	ZTE

cpe:2.3:o:zte:zxhn_f670_firmware:*:*:*:*:*:*:*:* Versions up to 1.1.10p3t18 Vulnerable ·ZTE
cpe:2.3:h:zte:zxhn_f670:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ZTE

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-7361
2026-10-03 Alias added: GHSA-vq42-379v-g652

References

Advisory 1

http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009383

TI-2018-05335 Out-of-bounds write in ZTE ZXHN F670 CVSS 3.0CRITICAL 9.8
TI-2018-05336 Information disclosure in ZTE ZXHN F670 CVSS 3.0CRITICAL 9.6
TI-2019-02572 OS command injection in ZTE ZXHN F670 CVSS 3.1HIGH 8.8
TI-2018-05339 Incorrect authorization in ZTE ZXHN F670 CVSS 3.0HIGH 8.8
TI-2018-05338 Improper access control in ZTE ZXHN F670 CVSS 3.0HIGH 8.8
TI-2019-02573 Cross-site scripting in ZTE ZXHN F670 CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences