VulnerabilityModified

CVE-2020-6871

The server management software module of ZTE has an authentication issue vulnerability, which allows users to skip the authentication of the server and execute some commands for high-level users.

CRITICAL 9.8EPSS 1.88%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.88%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The server management software module of ZTE has an authentication issue vulnerability, which allows users to skip the authentication of the server and execute some commands for high-level users. This affects: <R5300G4V03.08.0100/V03.07.0300/V03.07.0200/V03.07.0108/V03.07.0100/V03.05.0047/V03.05.0046/V03.05.0045/V03.05.0044/V03.05.0043/V03.05.0040/V03.04.0020;R8500G4V03.07.0103/V03.07.0101/V03.06.0100/V03.05.0400/V03.05.0020;R5500G4V03.08.0100/V03.07.0200/V03.07.0100/V03.06.0100>

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.88% probability · 78th percentile
CISA KEV: Not listed
Weakness: CWE-287
Affected: zte/r8500g4 firmware · zte/r5500g4 firmware · zte/r5300g4 firmware
Source: psirt@zte.com.cn

References

http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013203Vendor Advisory
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013203Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.