CVE-2018-7364

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-12-07 · updated 2026-06-17
Weakness: CWE-284

Description

All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability. Due to improper access control to devcomm process, an unauthorized remote attacker can exploit this vulnerability to execute arbitrary code with root privileges.

Affected products

ZTE ZXIN10-European region: before resv1.01.44 — fixed in resv1.01.44

How to fix

Upgrade to a fixed version: ZTE ZXIN10-European region resv1.01.44. Check the vendor advisory for mitigations.

References

http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009943
https://github.com/orangecertcc/security-research/security/advisories/GHSA-34f2-7h57-rg7p
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009943
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009943
https://github.com/orangecertcc/security-research/security/advisories/GHSA-34f2-7h57-rg7p
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009943

Get alerted when CVE-2018-7364 or the next vulnerability affects your stack