CVE-2017-10932
CRITICALZTE NR8000 Series < 12.17.20 - Unauthenticated Remote Code Execution via Java RMI Deserialization
Title source: llmDescription
All versions prior to V12.17.20 of the ZTE Microwave NR8000 series products - NR8120, NR8120A, NR8120, NR8150, NR8250, NR8000 TR and NR8950 are the applications of C/S architecture using the Java RMI service in which the servers use the Apache Commons Collections (ACC) library that may result in Java deserialization vulnerabilities. An unauthenticated remote attacker can exploit the vulnerabilities by sending a crafted RMI request to execute arbitrary code on the target host.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008422
Scores
CVSS v3
9.8
EPSS
0.1376
EPSS Percentile
94.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-502
Status
published
Products (7)
ZTE/NR8000 Series
All versions prior to V12.17.20
zte/nr8000tr_firmware
< 12.17.20
zte/nr8120_firmware
< 12.17.20
zte/nr8120a_firmware
< 12.17.20
zte/nr8150_firmware
< 12.17.20
zte/nr8250_firmware
< 12.17.20
zte/nr8950_firmware
< 12.17.20
Published
Sep 28, 2017
Tracked Since
Feb 18, 2026