Vulnerability Spotlight: Multiple vulnerabilities in ZTE MF971R LTE router
Summary: Cisco Talos discovered multiple vulnerabilities in the ZTE MF971R LTE portable router, all exploitable by sending a specially crafted HTTP request to the device. Talos specifically called out the combination of CVE-2021-21748 (pre-authentication stack-based buffer overflow) and CVE-2021-21745 (CSRF/Referer check bypass), which together allow an attacker to trigger arbitrary remote code without any authentication, and ZTE has released an update.
Bottom line: Two chained flaws give an unauthenticated attacker remote code execution on the router, and the trigger is a user visiting a malicious website - so the compromise can arrive through ordinary browsing on a device sitting at the network edge.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-21745CVE-2021-21748
- Related
- Deep dive: Vulnerabilities in ZTE router could lead to complete attacker control of the device Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026