CVE-2014-9021 - CVE House
Back to Database
Status published Medium CVE-2014-9021

Multiple cross-site scripting (XSS) vulnerabilities in ZTE ZXDSL 831 allow...

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in ZTE ZXDSL 831 allow remote attackers to inject arbitrary web script or HTML via the (1) tr69cAcsURL, (2) tr69cAcsUser, (3) tr69cAcsPwd, (4) tr69cConnReqPwd, or (5) tr69cDebugEnable parameter to the TR-069 client page (tr69cfg.cgi); the (6) timezone parameter to the Time and date page (sntpcfg.sntp); or the (7) hostname parameter in a save action to the Quick Stats page (psilan.cgi). NOTE: this issue was SPLIT from CVE-2014-9020 per ADT1 due to different affected products and codebases.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-9021

Credits & Attribution

No credits recorded in the NVD database.

References

More from zteusa

View All →
CVE-2018-15006
The ZTE ZMAX Champ Android device with a build fingerprint...
Medium 5.5
CVE-2018-15005
The ZTE ZMAX Champ Android device with a build fingerprint...
High 7.1
CVE-2018-14995
The ZTE Blade Vantage Android device with a build fingerprint...
Medium 4.7
CVE-2014-9027
Multiple cross-site request forgery (CSRF) vulnerabilities in ZTE ZXDSL 831CII...
Medium 6.8

Affected Vendor

Affected Software

zxdsl 831
Vulnerable Versions:
Unknown

Timeline

Official Publish: November 20th, 2014
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.