{"api_version":"1","generated_at":"2026-07-23T06:38:08+00:00","cve":"CVE-2017-10933","urls":{"html":"https://cve.report/CVE-2017-10933","api":"https://cve.report/api/cve/CVE-2017-10933.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-10933","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-10933"},"summary":{"title":"CVE-2017-10933","description":"All versions prior to V2.06.00.00 of ZTE ZXDT22 SF01, an monitoring system of ZTE energy product, are impacted by directory traversal vulnerability that allows remote attackers to read arbitrary files on the system via a full path name after host address.","state":"PUBLISHED","assigner":"zte","published_at":"2017-10-19 21:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-22","Directory Traversal"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008582","name":"http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008582","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Security Bulletin Details","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10933","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10933","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"ZTE","product":"ZXDT22 SF01","version":"affected All versions prior to V2.06.00.00","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"10933","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"zte","cpe5":"zxdt22_sf01","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"10933","vulnerable":"1","versionEndIncluding":"v2.06.00.00","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"zte","cpe5":"zxdt22_sf01_firmware","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T17:50:12.719Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008582"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"ZXDT22 SF01","vendor":"ZTE","versions":[{"status":"affected","version":"All versions prior to V2.06.00.00"}]}],"datePublic":"2017-10-09T00:00:00.000Z","descriptions":[{"lang":"en","value":"All versions prior to V2.06.00.00 of ZTE ZXDT22 SF01, an monitoring system of ZTE energy product, are impacted by directory traversal vulnerability that allows remote attackers to read arbitrary files on the system via a full path name after host address."}],"problemTypes":[{"descriptions":[{"description":"Directory Traversal","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-10-19T20:57:01.000Z","orgId":"6786b568-6808-4982-b61f-398b0d9679eb","shortName":"zte"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008582"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@zte.com.cn","DATE_PUBLIC":"2017-10-09T00:00:00","ID":"CVE-2017-10933","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"ZXDT22 SF01","version":{"version_data":[{"version_value":"All versions prior to V2.06.00.00"}]}}]},"vendor_name":"ZTE"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"All versions prior to V2.06.00.00 of ZTE ZXDT22 SF01, an monitoring system of ZTE energy product, are impacted by directory traversal vulnerability that allows remote attackers to read arbitrary files on the system via a full path name after host address."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Directory Traversal"}]}]},"references":{"reference_data":[{"name":"http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008582","refsource":"CONFIRM","url":"http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1008582"}]}}}},"cveMetadata":{"assignerOrgId":"6786b568-6808-4982-b61f-398b0d9679eb","assignerShortName":"zte","cveId":"CVE-2017-10933","datePublished":"2017-10-19T21:00:00.000Z","dateReserved":"2017-07-05T00:00:00.000Z","dateUpdated":"2024-09-16T23:10:37.132Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-10-19 21:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-22","Directory Traversal"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:zte:zxdt22_sf01_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"v2.06.00.00","matchCriteriaId":"BF0B856D-169F-4622-9271-BB738AE84961"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:zte:zxdt22_sf01:-:*:*:*:*:*:*:*","matchCriteriaId":"7AF580C7-ADB1-4E89-8012-BB7652669EEC"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"10933","Ordinal":"1","Title":"CVE-2017-10933","CVE":"CVE-2017-10933","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"10933","Ordinal":"1","NoteData":"All versions prior to V2.06.00.00 of ZTE ZXDT22 SF01, an monitoring system of ZTE energy product, are impacted by directory traversal vulnerability that allows remote attackers to read arbitrary files on the system via a full path name after host address.","Type":"Description","Title":"CVE-2017-10933"},{"CveYear":"2017","CveId":"10933","Ordinal":"2","NoteData":"2017-10-19","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"10933","Ordinal":"3","NoteData":"2017-10-19","Type":"Other","Title":"Modified"}]}}}