Software Engineering Institute

CWE-200: Information Exposure - CVE-2015-7248

Multiple information exposure vulnerabilities enable an attacker to obtain credentials and other sensitive details about the ZXHN H108N R1A.

1. User names and password hashes can be viewed in the page source of http://<IP>/cgi-bin/webproc
2. The configuration file of the device contains usernames, passwords, keys, and other values in plain text, which can be used by a user with lower privileges to gain admin account access. This issue also affects ZTE ZXV10 W300 models, version W300V1.0.0f_ER1_PE.

A LAN-based attacker can obtain credentials and configuration information, bypass authentication, access arbitrary files, and gain complete control of affected devices. Note that in some configurations, an external attacker may be able to leverage these vulnerabilities.

Apply an update

The vendor has issued ZTE.bhs.ZXHNH108NR1A.k_PE to address the vulnerabilities affecting ZTE ZXHN H108N R1A. Users are encouraged to contact their Internet service provider for updates.

Note that W300 models are no longer officially supported and will not be receiving any updates. Users should consider the following workaround.

Discontinue use

ZTE states:
The vulnerable W300 router was officially replaced by H108N V2.1 released in July 2014, and the vulnerable H108N was finished upgrading to version ZTE.bhs.ZXHNH108NR1A.k_PE through operator channel that all the vulnerabilities mentioned herein were fixed. ZTE recommends users to contact local operators for upgrade service.

Since patches will not be issued to address vulnerabilities in W300 routers, users should strongly consider discontinuing use of affected devices. Users of ISP-provisioned W300 devices should request replacement routers.