What’s Vulnerable › Vulnerabilities

CVE-2024-22069: Permission and Access Control Vulnerability in ZXV10 XT802/ET301

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-08 · updated 2026-06-17
• Weakness: CWE-269

Description

There is a permission and access control vulnerability of ZTE's ZXV10 XT802/ET301 product.Attackers with common permissions can log in the terminal web and change the password of the administrator illegally by intercepting requests to change the passwords.

Affected products

• ZTE Zxv10 Et301 Firmware: before v3.22.11p3 — fixed in v3.22.11p3
• ZTE Zxv10 Xt802 Firmware: before v2.24.10p1 — fixed in v2.24.10p1

How to fix

Upgrade to a fixed version: ZTE Zxv10 Et301 Firmware v3.22.11p3; ZTE Zxv10 Xt802 Firmware v2.24.10p1. Check the vendor advisory for mitigations.

References

• https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1036424

Get alerted when CVE-2024-22069 or the next vulnerability affects your stack