← Back

Znid 2426a Firmware

znid_2426a_firmware

Vendor: Dasanzhone • 3 CVEs

CVEs (3)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2014-8356
1Dasanzhone
1Znid 2426a Firmware
Nov 21, 2024
Nov 21, 2019
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified server response, related to an insecure direct object reference.
CVE-2014-9118
1Dasanzhone
1Znid 2426a Firmware
May 13, 2026
Oct 17, 2017
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddr parameter to zhnping.cmd.
CVE-2014-8357
1Dasanzhone
1Znid 2426a Firmware
May 13, 2026
Oct 17, 2017
N/A· v4
8.8 HIGH· v3
4.0 MEDIUM· v2
backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows remote attackers to obtain arbitrary user passwords via the sessionKey parameter i...Show more
backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a session key in a URL, which allows remote attackers to obtain arbitrary user passwords via the sessionKey parameter in a getConfig action to backupsettings.conf.Show less