CVE-2018-7366

Severity: medium (CVSS 6.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-28 · updated 2026-06-17
Weakness: CWE-863

Description

ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, the WASU versions up to V1.1.7 and the MGTV versions up to V1.4.6 have an authentication bypass vulnerability, which may allows an unauthorized user to perform unauthorized operations.

Affected products

ZTE ZXV10 B860AV2.1_ChinaMobile: before icnt_v1.3.3; before bestv_v1.2.2; before wasu_v1.1.7; before mgtv_v1.4.6 — fixed in bestv_v1.2.2, icnt_v1.3.3, mgtv_v1.4.6, wasu_v1.1.7

How to fix

Upgrade to a fixed version: ZTE ZXV10 B860AV2.1_ChinaMobile bestv_v1.2.2, icnt_v1.3.3, mgtv_v1.4.6, wasu_v1.1.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-7366 or the next vulnerability affects your stack