CVE-2014-9021: XSS
Multiple cross-site scripting (XSS) vulnerabilities in ZTE ZXDSL 831 allow remote attackers to inject arbitrary web script or HTML via the (1) tr69cAcsURL, (2) tr69cAcsUser, (3) tr69cAcsPwd, (4) tr69cConnReqPwd, or (5) tr69cDebugEnable parameter to the TR-069 client page (tr69cfg.cgi); the (6) timezone parameter to the Time and date page (sntpcfg.sntp); or the (7) hostname parameter in a save action to the Quick Stats page (psilan.cgi). NOTE: this issue was SPLIT from CVE-2014-9020 per ADT1 due to different affected products and codebases.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9021?
CVE-2014-9021 is classified with a high severity level due to multiple cross-site scripting vulnerabilities that allow remote code execution.
How do I fix CVE-2014-9021?
To fix CVE-2014-9021, ensure that you apply the latest firmware updates provided by ZTE for the ZXDSL 831 device.
What types of attacks can CVE-2014-9021 be exploited for?
CVE-2014-9021 can be exploited for cross-site scripting attacks, allowing an attacker to inject arbitrary scripts into the web pages viewed by users.
Which devices are affected by CVE-2014-9021?
CVE-2014-9021 specifically affects the ZTE ZXDSL 831 device model.
How can I determine if my device is vulnerable to CVE-2014-9021?
You can determine vulnerability to CVE-2014-9021 by checking if your device runs an outdated firmware version that is affected by the reported XSS vulnerabilities.