Vulnerability record · CVE-2014-4019 · published 20 February 2020

CVE-2014-4019: Zte zxv10 w300 firmware information exposure vulnerability

Zte · Zxv10 W300 Firmware

ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to read backup files via a direct request for rom-0.

7.5 CVSS 3.1 High EPSS 13% · top 3.9% CWE-200 · Information exposure

7.5CVSS 3.1 base score, v2 5.0

13%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References, 6 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Zxv10 W300 Firmware Zte

References

Link	Tags
http://packetstormsecurity.com/files/127129/ZTE-WXV10-W300-Disclosure-CSRF-Default.html	ExploitThird Party AdvisoryVDB Entry
http://www.exploit-db.com/exploits/33803	ExploitThird Party AdvisoryVDB Entry
http://www.osvdb.org/102668	Broken Link
https://osandamalith.wordpress.com/2014/06/15/zte-wxv10-w300-multiple-vulnerabilities/	ExploitThird Party Advisory
http://packetstormsecurity.com/files/127129/ZTE-WXV10-W300-Disclosure-CSRF-Default.html	ExploitThird Party AdvisoryVDB Entry
http://www.exploit-db.com/exploits/33803	ExploitThird Party AdvisoryVDB Entry
http://www.osvdb.org/102668	Broken Link
https://osandamalith.wordpress.com/2014/06/15/zte-wxv10-w300-multiple-vulnerabilities/	ExploitThird Party Advisory

Track CVE-2014-4019 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2015-7258Zte zxv10 w300 firmware vulnerabilityZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain user passwords by displaying …EPSS 13%24 Aug 2017 8.8CVE-2015-7259Zte zxv10 w300 firmware vulnerabilityZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid username and password pairs, …EPSS 9.5%24 Aug 2017 7.8CVE-2014-4018Zte zxv10 w300 firmware vulnerabilityThe ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK has a default password of admin for the admin account, which makes it easier for remote at…EPSS 6.3%16 Jul 2014 7.5CVE-2015-7257Zte zxv10 w300 firmware weak password recovery vulnerabilityZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated non-administrator users to change the admin p…EPSS 6.7%24 Aug 2017 6.8CVE-2014-4155Zte zxv10 w300 firmware cross-site request forgery vulnerabilityCross-site request forgery (CSRF) vulnerability in the ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK allows remote attackers to hijack the a…EPSS 2.3%19 Jun 2014 6.5CVE-2015-8703Zte zxhn h108n r1a firmware information exposure vulnerabilityZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE and ZXV10 W300 devices W300V1.0.0f_ER1_PE allow remote authenticated users to bypass inte…EPSS 4.9%30 Dec 2015 5.0CVE-2014-4154Zte zxv10 w300 firmware permissions and access controls vulnerabilityZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows…EPSS 6.6%16 Jul 2014 5.9CVE-2025-68686FortiOS symbolic link patch bypass exposes sensitive informationFortiOS contains an information exposure flaw (CWE-200) that lets a remote unauthenticated attacker bypass the patch for the symbolic link persistenc…KEVEPSS 30%analysed10 Feb 2026

Source: NIST National Vulnerability Database (record CVE-2014-4019), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.