{"id":"CVE-2014-2321","aliases":["EUVD-2014-2359","GHSA-wx3r-f6q6-jhjw"],"status":"published","title":"web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain...","description":"web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using \"set TelnetCfg\" commands to enable a TELNET service with specified credentials.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.59259,"percentile":0.99125,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-264"],"published":"2014-03-11T10:00:00Z","modified":"2026-06-17T00:06:24Z","exploits":[{"source":"nuclei","id":"CVE-2014-2321","title":"ZTE Cable Modem Web Shell","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-2321.yaml"},{"source":"pocgithub","id":"injectionmethod/Windows-ZTE-Loader","title":"injectionmethod/Windows-ZTE-Loader","date":"2023-06-02","url":"https://github.com/injectionmethod/Windows-ZTE-Loader"},{"source":"pocgithub","id":"injectionmethod/ZTE-Vuln-4-Skids","title":"injectionmethod/ZTE-Vuln-4-Skids","date":"2021-06-24","url":"https://github.com/injectionmethod/ZTE-Vuln-4-Skids"}],"products":[{"vendor":"zte","product":"f460"},{"vendor":"zte","product":"f660"}],"references":[{"url":"http://www.myxzy.com/post-411.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://community.rapid7.com/community/infosec/blog/2014/03/03/disclosure-r7-2013-18-zte-f460-and-zte-f660-webshellcmdgch-backdoor","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://www.kb.cert.org/vuls/id/600724","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2321"},{"url":"https://github.com/advisories/GHSA-wx3r-f6q6-jhjw"}],"sources":{"cve":[{"id":"CVE-2014-2321","description":"web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using \"set TelnetCfg\" commands to enable a TELNET service with specified credentials.","status":"published","published":"2014-03-11T10:00:00Z","modified":"2024-09-16T19:57:35.455Z","updated_at":"2026-11-02T14:33:43.566796Z"}],"euvd":[{"id":"EUVD-2014-2359","description":"web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using \"set TelnetCfg\" commands to enable a TELNET service with specified credentials.","status":"published","published":"2014-03-11T10:00:00Z","modified":"2024-09-16T19:57:35Z","updated_at":"2026-11-03T00:55:18.167658Z"}],"ghsa":[{"id":"GHSA-wx3r-f6q6-jhjw","title":"web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain...","description":"web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using \"set TelnetCfg\" commands to enable a TELNET service with specified credentials.","status":"published","published":"2022-05-17T04:49:54Z","modified":"2023-01-28T05:02:28Z","updated_at":"2026-11-02T14:43:47.163465Z"}],"nvd":[{"id":"CVE-2014-2321","description":"web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests, as demonstrated by using \"set TelnetCfg\" commands to enable a TELNET service with specified credentials.","status":"published","published":"2014-03-11T13:01:19.14Z","modified":"2026-06-17T00:06:24.36Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:53.710973Z"}]}}