{"cve":"CVE-2018-7366","nvd":{"published":"2018-12-28T16:29:06.067","modified":"2026-06-17T02:03:04.877","status":"Modified","description":"ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, the WASU versions up to V1.1.7 and the MGTV versions up to V1.4.6 have an authentication bypass vulnerability, which may allows an unauthorized user to perform unauthorized operations.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":6.8},"cwes":["CWE-863"],"references":["http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010023","http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010023"],"products":["zte:zxv10_b860av2.1_chinamobile_firmware"],"source":"nvd","synced_at":"2026-10-19T20:54:36.112582389+00:00"},"epss":{"cve":"CVE-2018-7366","score":0.0058,"percentile":0.47734,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}