CVE-2021-47740
KZTech JT3500V 4G LTE CPE 2.0.1 Insufficient Session Expiration Vulnerability
- Published
- Updated
- Reserved
- Assigned by
- VulnCheck
Description
KZTech JT3500V 4G LTE CPE 2.0.1 contains a session management vulnerability that allows attackers to reuse old session credentials without proper expiration. Attackers can exploit the weak session handling to maintain unauthorized access and potentially compromise device authentication mechanisms.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulnCheckCNA (assigner) | 4.0 | Medium6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| VulnCheckCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Deferred | 4.0 | Medium6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.42% · top 63% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.
Weakness
Affected products
KZ Broadband Technologies, Ltd. · JT3500V
- affected 2.0.1B1064
- affected 2.0.1B1047
KZ Broadband Technologies, Ltd. · AM6200M
- affected 2.0.0B3210
KZ Broadband Technologies, Ltd. · AM6000N
- affected 2.0.0B3042
KZ Broadband Technologies, Ltd. · AM5000W
- affected 2.0.0B3037
KZ Broadband Technologies, Ltd. · AM4200M
- affected 2.0.0B2996
KZ Broadband Technologies, Ltd. · AM4100V
- affected 2.0.0B2988
KZ Broadband Technologies, Ltd. · AM3500MW
- affected 2.0.0B1092
KZ Broadband Technologies, Ltd. · AM3410V
- affected 2.0.0B1085
KZ Broadband Technologies, Ltd. · AM3300V
- affected 2.0.0B1060
KZ Broadband Technologies, Ltd. · AM3100E
- affected 2.0.0B981
KZ Broadband Technologies, Ltd. · AM3100V
- affected 2.0.0B946
KZ Broadband Technologies, Ltd. · AM3000M
- affected 2.0.0B21
KZ Broadband Technologies, Ltd. · KZ7621U
- affected 2.0.0B14
KZ Broadband Technologies, Ltd. · KZ3220M
- affected 2.0.0B04
KZ Broadband Technologies, Ltd. · KZ3120R
- affected 2.0.0B01
References (7)
- Zero Science Lab Disclosure (ZSL-2021-5646) (opens in a new tab)third-party-advisory
- Packet Storm Security Exploit Entry (opens in a new tab)exploit
- IBM X-Force Vulnerability Exchange Entry (opens in a new tab)vdb-entry
- KZ TECH Vendor Homepage (opens in a new tab)product
- JATON TEC Homepage (opens in a new tab)product
- Neotel Vendor Homepage (opens in a new tab)product
- VulnCheck Advisory: KZTech JT3500V 4G LTE CPE 2.0.1 Insufficient Session Expiration Vulnerability (opens in a new tab)third-party-advisory
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2021-47740)Record last updated .