The ZTE ZXV10 W300 router with firmware W300V1.0.0aZRDLK has a default password of admin for the admin account, which makes it easier for remote attackers to obtain access via unspecified vectors.
Cross-site request forgery (CSRF) vulnerability in the ZTE ZXV10 W300 router with firmware W300V1.0.0aZRDLK allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a request to Forms/toolsadmin1.
ZTE ZXV10 W300 router with firmware W300V1.0.0aZRDLK stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the PPPoE/PPPoA password via a direct request for basic/tc2wanfun.js.