(
diff)
← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| ZTE ZXHN F477V2 (F477V2)
|
|
Security Grade
Calculator v1
|
ZTE ZXHN F477V2 (F477V2)
Category: Router • Model / Gen: F477V2
Release Date: 2018-01-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
None
|
—
|
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
|
| Prior attacks
|
Rare
|
🔗 Proof
|
|
| Updatability
|
None
|
—
|
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
—
|
|
| Communications
|
Encrypted with obselete encryption
|
—
|
|
| Storage
|
No encryption
|
—
|
|
| Category Score
|
Score: 3 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
—
|
|
| Authentication
|
Basic
|
🔗 Proof
|
|
| Brute-force protection
|
Basic
|
—
|
|
| Event logging
|
Partial logging
|
—
|
|
| Passwords
|
Default/Common/Easy to guess
|
—
|
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
ZTE Embedded OS (Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: Broadcom BCM68380 • GPU:
|
| Memory & Storage
|
Memory: 256 MB RAM • Storage: 128MB Flash
|
| Power, Battery & Charging
|
Battery: None • Power: 12V DC adapter • Charging:
|
| Display & Camera
|
Display: None • Camera: None
|
| Sound & Connectivity
|
Sound: • Connectivity: 4 x GE LAN, GPON/EPON, 2.4GHz Wi-Fi
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
This EPON ONU is affected by CVE-2022-23135, a directory traversal flaw in ZTE ZXHN F477 home gateways (CVSS 6.5, Medium). An authenticated attacker can modify the FTP destination path to access or modify system files, which leads to information leakage and disrupted device operation. All firmware versions up to V9.0.0P1N28 are affected. In addition, the device label prints the default management address, username and password in plain text, so anyone with physical access can log in as an administrator.
