By default, ZTE Score M Mobile Phone comes with a hardcoded password. The Device has a password of ztex1609523 which is publicly known and documented, which grants access to a root shell backdoor in /system/bin/sync_agent. This allows attackers to trivially access the device and gain privileged access.
Classification
Location:
Local Access Required,
Mobile Phone / Hand-held Device
Attack Type:
Authentication Management
Impact:
Loss of Integrity
Solution:
Solution Unknown
Exploit:
Exploit Public
Disclosure:
Uncoordinated Disclosure
Solution
OSVDB is not aware of a solution for this vulnerability.
