CVE-2021-21737

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A smart STB product of ZTE is impacted by a permission and access control vulnerability. Due to insufficient protection of system application, attackers could use this vulnerability to tamper with the system desktop and affect system customization functions. This affects: ZXV10 B860H V5.0, V83011303.0010, V83011303.0016

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-217386.1ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities. Due to insufficient input verification, the CVE-2021-217394.6A ZTE's product of the transport network access layer has a security vulnerability. Because the system does not sufficiently verify the data CVE-2021-21744.4Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.33 and prior and CVE-2021-217402.4There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product. The attacker could insert CVE-2021-217419.8There is a command execution vulnerability in a ZTE conference management system. As some services are enabled by default, the attacker coul CVE-2021-217425.5There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings, attackers c CVE-2021-217434.3ZTE MF971R product has a CRLF injection vulnerability. An attacker could exploit the vulnerability to modify the HTTP response header inform CVE-2021-217447.5ZTE MF971R product has a configuration file control vulnerability. An attacker could use this vulnerability to modify the configuration para CVE-2021-217454.3ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to CVE-2021-217466.1ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information.CVE-2021-217476.1ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information.CVE-2021-217489.8ZTE MF971R product has two stack-based buffer overflow vulnerabilities. An attacker could exploit the vulnerabilities to execute arbitrary c