Administrator account takeover via intercepted password-change request

Improper privilege management in ZTE ZXV10 XT802 and ET301 terminals allows remote authenticated users to change the administrator password. The terminal web interface accepts an intercepted password-change request from a common-permission account and applies it to the administrator account without enforcing the intended privilege boundary. A low-privileged login and user interaction are required; successful exploitation replaces the administrator credential and enables control of the privileged account.