VulnerabilityModified

CVE-2019-3411

All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by information leak vulnerability.

HIGH 7.5EPSS 1.27%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.27%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by information leak vulnerability. Due to some interfaces can obtain the WebUI login password without login, an attacker can exploit the vulnerability to obtain sensitive information about the affected components.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 1.27% probability · 68th percentile
CISA KEV: Not listed
Weakness: CWE-306
Affected: zte/mf920 firmware
Source: psirt@zte.com.cn

References

http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010686Vendor Advisory
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010686Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.