CVE-2024-22066

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router . An authenticated attacker could use the vulnerability to obtain sensitive information about the device.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-294

Affected software

Vendor	Product	Versions
ZTE	ZXR10 1800-2S	ZSRV2 V3.00.40
zte	zxr10_1800-2s_firmware	3.00.40

References

https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/1171513586716225590Vendor Advisory

Timeline

Published: Oct 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-220678.8ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an auth CVE-2024-220686.5Improper Privilege Management vulnerability in ZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series on 64 bit allows Functio CVE-2024-220698.8There is a permission and access control vulnerability of ZTE's ZXV10 XT802/ET301 product.Attackers with common permissions can log in the t CVE-2024-22076.0Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, whi CVE-2024-220749.8Dynamsoft Service 1.8.1025 through 1.8.2013, 1.7.0330 through 1.7.2531, 1.6.0428 through 1.6.1112, 1.5.0625 through 1.5.3116, 1.4.0618 throu CVE-2024-220756.1Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.CVE-2024-220769.8MyQ Print Server before 8.2 patch 43 allows remote authenticated administrators to execute arbitrary code via PHP scripts that are reached t CVE-2024-220775.3An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The SQLite database file has weak permissions.CVE-2024-220788.8An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Privilege escalation can occur via world writable CVE-2024-220797.5An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Directory traversal can occur via the system logs CVE-2024-22088.8Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, whi CVE-2024-220809.8An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated memory corruption can occur during