Deep dive: Vulnerabilities in ZTE router could lead to complete attacker control of the device

Summary: Cisco Talos disclosed multiple vulnerabilities in the ZTE MF971R wireless hotspot and router in October, and after ZTE issued a patch, researchers took a closer look at two of them, CVE-2021-21748 and CVE-2021-21745. Researcher Marcin Noga's paper walks through how he found the flaws and shows how an attacker could chain the two together to completely take over a device.
What you should know: Two patched vulnerabilities in a consumer-grade hotspot can be chained into full device takeover, which means the patch deadline is the only thing standing between an attacker and complete control of the hardware.

Read the original at Cisco Talos ↗

Topics: Cloud Security
Mentions: CVE-2021-21745 CVE-2021-21748
Related: Vulnerability Spotlight: Multiple vulnerabilities in ZTE MF971R LTE router Cyber Risks ·
Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026
New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026