How severe is CVE-2017-10935?

CVE-2017-10935 has a CVSS 3.x base score of 7.2, rated high severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2017-10935 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (66th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-10935?

CVE-2017-10935 affects Zte Zxr10 1800-2s Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2017-10935?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2017-10935 published?

CVE-2017-10935 was published on 2018-07-25 and last updated on 2026-06-17.

CVE-2017-10935

CVE-2017-10935 is a high-severity vulnerability in Zte Zxr10 1800-2s Firmware with a CVSS 3.x base score of 7.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.2)
CVSS v2: 4.0
EPSS exploit prediction: 1% (66th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Zte Zxr10 1800-2s Firmware
Published: 2018-07-25
Last modified: 2026-06-17

Description

All versions prior to ZSRV2 V3.00.40 of the ZTE ZXR10 1800-2S products allow remote authenticated users to bypass the original password authentication protection to change other user's password.

Frequently asked questions

What is CVE-2017-10935?: All versions prior to ZSRV2 V3.00.40 of the ZTE ZXR10 1800-2S products allow remote authenticated users to bypass the original password authentication protection to change other user's password.
How severe is CVE-2017-10935?: CVE-2017-10935 has a CVSS 3.x base score of 7.2, rated high severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2017-10935 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (66th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-10935?: CVE-2017-10935 affects Zte Zxr10 1800-2s Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2017-10935?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2017-10935 published?: CVE-2017-10935 was published on 2018-07-25 and last updated on 2026-06-17.

References

http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008723

Affected products (1)

cpe:2.3:o:zte:zxr10_1800-2s_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Zte Zxr10 1800-2s Firmware

CVE-2017-10930 — Critical (CVSS 9.8): The ZXR10 1800-2S before v3.00.40 incorrectly restricts access to a resource from an unauthorized actor, resulting in…
CVE-2024-22066 — High (CVSS 7.5): There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router . An authenticated…
CVE-2017-10931 — High (CVSS 7.5): The ZXR10 1800-2S before v3.00.40 incorrectly restricts the download of the file directory range for WEB users,…
CVE-2024-22068 — Medium (CVSS 6.0): Improper Privilege Management vulnerability in ZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series on…

All CVEs affecting Zte Zxr10 1800-2s Firmware →