VulnerabilityModified

CVE-2019-3416

All versions up to V81511329.1008 of ZTE ZXV10 B860A products are impacted by input validation vulnerability.

CRITICAL 9.8EPSS 1.05%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.05%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

All versions up to V81511329.1008 of ZTE ZXV10 B860A products are impacted by input validation vulnerability. Due to input validation, unauthorized users can take advantage of this vulnerability to control the user terminal system.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.05% probability · 62th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: zte/zxv10 b860a firmware
Source: psirt@zte.com.cn

References

http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011263Vendor Advisory
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011263Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.