CVE-2014-2321: web_shell_cmd.gch on ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access...

Security readout for executives and security teams

CVE-2014-2321 describes a backdoor-like management function in ZTE F460 and F660 cable modems. A remote attacker could obtain administrative control by abusing the web_shell_cmd.gch endpoint to change device settings, including enabling Telnet with chosen credentials. Exposure is most likely where ZTE F460 or F660 modem management interfaces are reachable from untrusted networks or provider-side management paths. Evidence is incomplete for exact firmware versions and deployment scope. Prioritize exposed or provider-managed ZTE F460/F660 deployments because successful abuse can mean full device administration. Urgency depends on whether these models are present and reachable from untrusted networks. Mitigation focus: Identify any ZTE F460 or F660 devices in production or customer networks.; Check vendor or service-provider guidance for supported firmware or replacement direction.; Restrict modem management interfaces to trusted administrative networks only..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.