CVE-2021-47740
6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Summary
KZTech JT3500V 4G LTE CPE 2.0.1 contains a session management vulnerability that allows attackers to reuse old session credentials without proper expiration. Attackers can exploit the weak session handling to maintain unauthorized access and potentially compromise device authentication mechanisms.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| KZ Broadband Technologies, Ltd. | JT3500V | 2.0.1B1064 | affected |
| KZ Broadband Technologies, Ltd. | JT3500V | 2.0.1B1047 | affected |
| KZ Broadband Technologies, Ltd. | AM6200M | 2.0.0B3210 | affected |
| KZ Broadband Technologies, Ltd. | AM6000N | 2.0.0B3042 | affected |
| KZ Broadband Technologies, Ltd. | AM5000W | 2.0.0B3037 | affected |
| KZ Broadband Technologies, Ltd. | AM4200M | 2.0.0B2996 | affected |
| KZ Broadband Technologies, Ltd. | AM4100V | 2.0.0B2988 | affected |
| KZ Broadband Technologies, Ltd. | AM3500MW | 2.0.0B1092 | affected |
| KZ Broadband Technologies, Ltd. | AM3410V | 2.0.0B1085 | affected |
| KZ Broadband Technologies, Ltd. | AM3300V | 2.0.0B1060 | affected |
| KZ Broadband Technologies, Ltd. | AM3100E | 2.0.0B981 | affected |
| KZ Broadband Technologies, Ltd. | AM3100V | 2.0.0B946 | affected |
| KZ Broadband Technologies, Ltd. | AM3000M | 2.0.0B21 | affected |
| KZ Broadband Technologies, Ltd. | KZ7621U | 2.0.0B14 | affected |
| KZ Broadband Technologies, Ltd. | KZ3220M | 2.0.0B04 | affected |
| KZ Broadband Technologies, Ltd. | KZ3120R | 2.0.0B01 | affected |
Weaknesses
- CWE-613: Insufficient Session Expiration
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: yes
- Technical Impact: partial
References
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5646.php
- https://packetstormsecurity.com/files/161892/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/198471
- http://www.kzbtech.com/
- https://www.jatontech.com/
- https://neotel.mk/
- https://www.vulncheck.com/advisories/kztech-jtv-g-lte-cpe-insufficient-session-expiration-vulnerability
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.