CVE-2021-21745

What it actually does

CVE-2021-21745 is a cross-site request forgery weakness in ZTE MF971R firmware. The device’s web management interface relies on weak Referer-based request validation and lacks effective CSRF protection for authorization-changing actions. If an authenticated administrator is tricked into visiting attacker-controlled content, the attacker can cause the administrator’s browser to send unauthorized management requests to the device. The vulnerability primarily affects integrity: configuration changes or administrative actions may be performed without the user intentionally initiating them.

Why it matters to the business

Successful exploitation can let an attacker change settings on an affected ZTE MF971R mobile router or hotspot, potentially disrupting connectivity, weakening network security, changing device configuration, or enabling follow-on access. The CVSS score is moderate, but the EPSS score is relatively high and exploit maturity is listed as weaponized, so exposed or actively administered devices should be treated as a practical risk even though this is not currently listed in CISA KEV and is not known to be ransomware-associated.

How an attack unfolds

An attacker first identifies that a target user administers or is currently authenticated to a ZTE MF971R device through its web interface. The attacker then prepares a malicious web page, email link, advertisement, or embedded resource that automatically submits crafted HTTP requests to the device’s management interface. When the authenticated user clicks the link or loads the attacker-controlled content from a browser that can reach the device, the browser includes the user’s existing session context. Because the device does not properly enforce CSRF tokens or robust origin validation, the management action can be accepted as if the administrator performed it intentionally. Depending on the exposed management functions, the attacker may be able to alter configuration values, perform unauthorized administrative operations, or weaken device security settings.

How to fix it

Upgrade the ZTE MF971R firmware to a vendor-provided version that corrects the CSRF/Referer authentication bypass if one is available through ZTE or the carrier/OEM firmware distribution channel. No fixed version was provided in the supplied vulnerability metadata, so administrators should verify the latest firmware directly with the vendor, carrier, or device management portal. If an update is not available, reduce exposure by disabling remote administration, restricting the management interface to trusted local networks only, changing default credentials, logging out of the administrative interface after use, using a dedicated browser profile for device administration, and avoiding browsing untrusted websites while authenticated to the device. Where possible, place management access behind network controls or an isolated administrative network.

How to confirm the fix worked

Confirm exposure by inventorying ZTE MF971R devices and recording their firmware versions, then comparing them with the latest firmware available from the vendor or carrier. Validate that the management interface is not reachable from untrusted networks and that remote administration is disabled unless explicitly required. After remediation, test that state-changing administrative requests require an unpredictable CSRF token or equivalent anti-CSRF control and are rejected when submitted without the expected token or from an untrusted origin. Also verify that administrative sessions expire appropriately and that configuration changes require intentional authenticated interaction.

Typical attack path

1. Identify a ZTE MF971R device and determine that its web management interface is reachable from a user’s browser.
2. Craft a malicious page or link that submits state-changing HTTP requests to the device management interface.
3. Induce an authenticated device administrator to open the link or page through phishing, messaging, a compromised site, or malicious embedded content.
4. The administrator’s browser sends the forged request to the device using the existing authenticated session.
5. The device accepts the request because CSRF protection and Referer validation are insufficient.
6. The attacker’s intended configuration or authorization-changing operation is applied to the device.

How to detect it

There are no broadly reliable public file, process, or network IOCs for this vulnerability because exploitation consists of forged web requests sent through an authenticated user’s browser to the device management interface. To investigate possible exploitation, review ZTE MF971R web management logs, configuration change history, administrative audit records, DHCP/client association logs, and upstream network logs if available. Look for state-changing management requests that occurred shortly after a user visited an external website, requests with missing or unexpected Origin or Referer headers, administrative actions from unusual client IP addresses on the local network, configuration changes outside maintenance windows, and changes to DNS, Wi-Fi credentials, firewall settings, port forwarding, APN settings, remote management, or administrator credentials. Browser history on administrator workstations may help correlate suspicious external pages with device configuration changes. If logging is limited, compare current device configuration against a known-good baseline and review carrier/vendor management portals for recent firmware or configuration events.

What your security team should do

• Prioritize inventory and review of all ZTE MF971R devices because exploit maturity is listed as weaponized and EPSS indicates meaningful likelihood of exploitation.
• Check vendor and carrier firmware channels for a patched firmware release; apply it where available.
• Disable remote administration and restrict the device web management interface to trusted local administrative networks.
• Advise administrators not to remain logged in to the device web interface while browsing email, messaging links, or unrelated websites.
• Review recent device configuration changes for unexpected modifications, especially security, access, DNS, APN, Wi-Fi, firewall, and management settings.
• Change administrative passwords if unauthorized configuration activity is suspected.
• Where the device cannot be patched, consider replacing it with a supported model that has maintained firmware and modern CSRF protections.