CVE-2021-47740
KZTech JT3500V 4G LTE CPE 2.0.1 Insufficient Session Expiration Vulnerability
- State
- Published
- Severity
- 6.9 Medium
- Published
- Dec 31, 2025
- Updated
- Jan 2, 2026
- Reserved
- Dec 23, 2025
Description
KZTech JT3500V 4G LTE CPE 2.0.1 contains a session management vulnerability that allows attackers to reuse old session credentials without proper expiration. Attackers can exploit the weak session handling to maintain unauthorized access and potentially compromise device authentication mechanisms.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-613 Insufficient Session Expiration
Affected Products
| Product | Versions |
|---|---|
JT3500VKZ Broadband Technologies, Ltd. |
|
AM6200MKZ Broadband Technologies, Ltd. |
|
AM6000NKZ Broadband Technologies, Ltd. |
|
AM5000WKZ Broadband Technologies, Ltd. |
|
AM4200MKZ Broadband Technologies, Ltd. |
|
AM4100VKZ Broadband Technologies, Ltd. |
|
AM3500MWKZ Broadband Technologies, Ltd. |
|
AM3410VKZ Broadband Technologies, Ltd. |
|
AM3300VKZ Broadband Technologies, Ltd. |
|
AM3100EKZ Broadband Technologies, Ltd. |
|
AM3100VKZ Broadband Technologies, Ltd. |
|
AM3000MKZ Broadband Technologies, Ltd. |
|
KZ7621UKZ Broadband Technologies, Ltd. |
|
KZ3220MKZ Broadband Technologies, Ltd. |
|
KZ3120RKZ Broadband Technologies, Ltd. |
|
References
- Zero Science Lab Disclosure (ZSL-2021-5646)third-party-advisory
- Packet Storm Security Exploit Entryexploit
- IBM X-Force Vulnerability Exchange Entryvdb-entry
- KZ TECH Vendor Homepageproduct
- JATON TEC Homepageproduct
- Neotel Vendor Homepageproduct
- VulnCheck Advisory: KZTech JT3500V 4G LTE CPE 2.0.1 Insufficient Session Expiration Vulnerabilitythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.