CVE-2014-8357: backupsettings.html in the web administrative portal in Zhone zNID GPON 2426A before S3.0.501 places a sess...

Security readout for executives and security teams

This issue affects the Zhone zNID GPON 2426A web admin portal before firmware S3.0.501. The portal exposes a session key in a URL, which can let a remote attacker use that key to retrieve configuration data containing user passwords. The business risk is credential disclosure on a network access device. Exposure is most likely where affected GPON devices have the web administrative portal reachable from untrusted networks or broadly accessible internal networks. The bundle only identifies Zhone zNID GPON 2426A before S3.0.501. Treat this as a high-priority network-device credential exposure if affected devices are present. The urgency depends on admin-portal reachability and whether exposed passwords could enable broader network access. Mitigation focus: Identify any Zhone zNID GPON 2426A devices in inventory.; Check firmware; prioritize devices running versions before S3.0.501.; Consult vendor guidance and update to a fixed firmware where available..

Prepared

Jun 12, 2026, 20:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.