CVE-2021-21731

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A CSRF vulnerability exists in the management page of a ZTE product.The vulnerability is caused because the management page does not fully verify whether the request comes from a trusted user. The attacker could submit a malicious request to the affected device to delete the data. This affects: ZXCLOUD iRAI All versions up to KVM-ProductV6.03.04

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Apr 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-217327.5A mobile phone of ZTE is impacted by improper access control vulnerability. Due to improper permission settings, third-party applications ca CVE-2021-217334.9The management system of ZXCDN is impacted by the information leak vulnerability. Attackers can make further analysis according to the infor CVE-2021-217346.5Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command. Thi CVE-2021-217356.5A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could e CVE-2021-217367.2A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management CVE-2021-217377.5A smart STB product of ZTE is impacted by a permission and access control vulnerability. Due to insufficient protection of system applicatio CVE-2021-217386.1ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities. Due to insufficient input verification, the CVE-2021-217394.6A ZTE's product of the transport network access layer has a security vulnerability. Because the system does not sufficiently verify the data CVE-2021-21744.4Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and CVE-2021-217402.4There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product. The attacker could insert CVE-2021-217419.8There is a command execution vulnerability in a ZTE conference management system. As some services are enabled by default, the attacker coul CVE-2021-217425.5There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings, attackers c