CVE-2021-47740KZTech JT3500V 4G LTE CPE 2.0.1 Insufficient Session Expiration Vulnerability
- 6.9MediumCVSS base score
- 0.42%Exploitation in 30 daysEPSS · top 63% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- YesPublic exploitsa reference or SSVC says so
Description
KZTech JT3500V 4G LTE CPE 2.0.1 contains a session management vulnerability that allows attackers to reuse old session credentials without proper expiration. Attackers can exploit the weak session handling to maintain unauthorized access and potentially compromise device authentication mechanisms.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. A reference of the record is tagged as an exploit. CISA's SSVC rates its exploitation: a proof of concept is public.
Show the exploits1
References tagged exploit1 reference
Timeline
ID reserved
By VulnCheck
- 8 days later
· 8 days later
Published
- 2 days later
· 2 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulnCheckCNA (assigner) | 4.0 | Medium6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| VulnCheckCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Deferred | 4.0 | Medium6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.42% · top 63% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.
Affected products
KZ Broadband Technologies, Ltd. · JT3500V
- affected 2.0.1B1064
- affected 2.0.1B1047
KZ Broadband Technologies, Ltd. · AM6200M
- affected 2.0.0B3210
KZ Broadband Technologies, Ltd. · AM6000N
- affected 2.0.0B3042
KZ Broadband Technologies, Ltd. · AM5000W
- affected 2.0.0B3037
KZ Broadband Technologies, Ltd. · AM4200M
- affected 2.0.0B2996
KZ Broadband Technologies, Ltd. · AM4100V
- affected 2.0.0B2988
KZ Broadband Technologies, Ltd. · AM3500MW
- affected 2.0.0B1092
KZ Broadband Technologies, Ltd. · AM3410V
- affected 2.0.0B1085
KZ Broadband Technologies, Ltd. · AM3300V
- affected 2.0.0B1060
KZ Broadband Technologies, Ltd. · AM3100E
- affected 2.0.0B981
KZ Broadband Technologies, Ltd. · AM3100V
- affected 2.0.0B946
KZ Broadband Technologies, Ltd. · AM3000M
- affected 2.0.0B21
KZ Broadband Technologies, Ltd. · KZ7621U
- affected 2.0.0B14
KZ Broadband Technologies, Ltd. · KZ3220M
- affected 2.0.0B04
KZ Broadband Technologies, Ltd. · KZ3120R
- affected 2.0.0B01
References
References7
- Zero Science Lab Disclosure (ZSL-2021-5646) (opens in a new tab)third-party-advisory
- Packet Storm Security Exploit Entry (opens in a new tab)exploit
- IBM X-Force Vulnerability Exchange Entry (opens in a new tab)vdb-entry
- KZ TECH Vendor Homepage (opens in a new tab)product
- JATON TEC Homepage (opens in a new tab)product
- Neotel Vendor Homepage (opens in a new tab)product
- VulnCheck Advisory: KZTech JT3500V 4G LTE CPE 2.0.1 Insufficient Session Expiration Vulnerability (opens in a new tab)third-party-advisory
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-206077 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2021-47740)Record last updated .