CVE-2021-21732

A mobile phone of ZTE is impacted by improper access control vulnerability. Due to improper permission settings, third-party applications can read some files in the proc file system without authorization. Attackers could exploit this vulnerability to obtain sensitive information. This affects Axon 11 5G ZTE/CN_P725A12/P725A12:10/QKQ1.200816.002/20201116.175317:user/release-keys.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015064	Vendor Advisory
https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015064	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:zte:axon_11_5g_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:zte:axon_11_5g:-:*:*:*:*:*:*:*

History

21 Nov 2024, 05:48

Type	Values Removed	Values Added
References	~~() https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015064 - Vendor Advisory~~	() https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015064 - Vendor Advisory

Information

Published : 2021-05-19 11:15

Updated : 2024-11-21 05:48

NVD link : CVE-2021-21732

Mitre link : CVE-2021-21732

CVE.ORG link : CVE-2021-21732

JSON object : View

Products Affected

zte

axon_11_5g_firmware
axon_11_5g

CWE

NVD-CWE-Other

{"id": "CVE-2021-21732", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-05-19T11:15:07.757", "references": [{"url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015064", "tags": ["Vendor Advisory"], "source": "psirt@zte.com.cn"}, {"url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1015064", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "A mobile phone of ZTE is impacted by improper access control vulnerability. Due to improper permission settings, third-party applications can read some files in the proc file system without authorization. Attackers could exploit this vulnerability to obtain sensitive information. This affects Axon 11 5G ZTE/CN_P725A12/P725A12:10/QKQ1.200816.002/20201116.175317:user/release-keys."}, {"lang": "es", "value": "Un tel\u00e9fono m\u00f3vil de ZTE est\u00e1 afectado por una vulnerabilidad de control de acceso inapropiado. Debido a una configuraci\u00f3n de permisos inapropiada, unas aplicaciones de terceros pueden leer algunos archivos en el sistema de archivos proc sin autorizaci\u00f3n. Los atacantes podr\u00edan explotar esta vulnerabilidad para conseguir informaci\u00f3n confidencial. Esto afecta a Axon 11 5G ZTE/CN_P725A12/P725A12: 10/QKQ1.200816.002/20201116.175317: usuario/teclas de liberaci\u00f3n"}], "lastModified": "2024-11-21T05:48:54.023", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:zte:axon_11_5g_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C956D21-AF7F-447D-B3C2-7C7A367B5BD5", "versionEndExcluding": "2021.5.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:zte:axon_11_5g:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0AB053B1-08C9-41C1-BD28-06A43B722C86"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@zte.com.cn"}