CVE-2021-21734

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-28 · updated 2026-06-17
Weakness: CWE-312

Description

Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command. This affects: ZTE PON MDU device ZXA10 F821 V1.7.0P3T22, ZXA10 F822 V1.4.3T6, ZXA10 F819 V1.2.1T5, ZXA10 F832 V1.1.1T7, ZXA10 F839 V1.1.0T8, ZXA10 F809 V3.2.1T1, ZXA10 F822P V1.1.1T7, ZXA10 F832 V2.00.00.01

Affected products

ZTE Zxa10 F809 Firmware: 3.2.1t1
ZTE Zxa10 F819 Firmware: 1.2.1t5
ZTE Zxa10 F821 Firmware: 1.7.0p3t22
ZTE Zxa10 F822 Firmware: 1.4.3t6
ZTE Zxa10 F822P Firmware: 1.1.1t7
ZTE Zxa10 F832 Firmware: 1.1.1t7
ZTE Zxa10 F832V2 Firmware: 2.00.00.01
ZTE Zxa10 F839 Firmware: 1.1.0t8

References

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015524
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015524

Get alerted when CVE-2021-21734 or the next vulnerability affects your stack