CVE-2021-21734

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command. This affects: ZTE PON MDU device ZXA10 F821 V1.7.0P3T22, ZXA10 F822 V1.4.3T6, ZXA10 F819 V1.2.1T5, ZXA10 F832 V1.1.1T7, ZXA10 F839 V1.1.0T8, ZXA10 F809 V3.2.1T1, ZXA10 F822P V1.1.1T7, ZXA10 F832 V2.00.00.01

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

No affected versions have been published.

Timeline

Published: May 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-217356.5A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could e CVE-2021-217367.2A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management CVE-2021-217377.5A smart STB product of ZTE is impacted by a permission and access control vulnerability. Due to insufficient protection of system applicatio CVE-2021-217386.1ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities. Due to insufficient input verification, the CVE-2021-217394.6A ZTE's product of the transport network access layer has a security vulnerability. Because the system does not sufficiently verify the data CVE-2021-21744.4Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and CVE-2021-217402.4There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product. The attacker could insert CVE-2021-217419.8There is a command execution vulnerability in a ZTE conference management system. As some services are enabled by default, the attacker coul CVE-2021-217425.5There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings, attackers c CVE-2021-217434.3ZTE MF971R product has a CRLF injection vulnerability. An attacker could exploit the vulnerability to modify the HTTP response header inform CVE-2021-217447.5ZTE MF971R product has a configuration file control vulnerability. An attacker could use this vulnerability to modify the configuration para CVE-2021-217454.3ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to