high8.8Public exploit code
CVE-2014-8356
The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified serve…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ZHONE < S3.0.501 - Multiple Vulnerabilities2015-10-13 · remote · hardware
Impact
The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified server response, related to an insecure direct object reference.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dasanzhone | Znid 2426a Firmware | before s3.0.501 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/133921/Zhone-Insecure-Reference-Password-Disclosure-Command-Injection.html
- http://seclists.org/fulldisclosure/2015/Oct/57
- https://www.exploit-db.com/exploits/38453/
- http://packetstormsecurity.com/files/133921/Zhone-Insecure-Reference-Password-Disclosure-Command-Injection.html
- http://seclists.org/fulldisclosure/2015/Oct/57
- https://www.exploit-db.com/exploits/38453/