CVE-2021-21736

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end app, users whose sharing permissions have been revoked can still control the camera, such as restarting the camera, restoring factory settings, etc.. This affects ZXHN HS562 V1.0.0.0B2.0000, V1.0.0.0B3.0000E

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published: Jun 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-217377.5A smart STB product of ZTE is impacted by a permission and access control vulnerability. Due to insufficient protection of system applicatio CVE-2021-217386.1ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities. Due to insufficient input verification, the CVE-2021-217394.6A ZTE's product of the transport network access layer has a security vulnerability. Because the system does not sufficiently verify the data CVE-2021-21744.4Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and CVE-2021-217402.4There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product. The attacker could insert CVE-2021-217419.8There is a command execution vulnerability in a ZTE conference management system. As some services are enabled by default, the attacker coul CVE-2021-217425.5There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings, attackers c CVE-2021-217434.3ZTE MF971R product has a CRLF injection vulnerability. An attacker could exploit the vulnerability to modify the HTTP response header inform CVE-2021-217447.5ZTE MF971R product has a configuration file control vulnerability. An attacker could use this vulnerability to modify the configuration para CVE-2021-217454.3ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to CVE-2021-217466.1ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information.CVE-2021-217476.1ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information.