VulnerabilityModified

CVE-2020-6879

Some ZTE devices have input verification vulnerabilities.

LOW 3.5EPSS 0.69%

Does this matter?

Lower severity and a low EPSS score (0.69%). Track it; it rarely justifies an emergency change on its own.

Description

Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule configuration interface. The WEB service backend fails to effectively verify the abnormal input. As a result, the attacker can successfully use the vulnerability to tamper parameter values. This affects: ZXHN Z500 V1.0.0.2B1.1000 and ZXHN F670L V1.1.10P1N2E. This is fixed in ZXHN Z500 V1.0.1.1B1.1000 and ZXHN F670L V1.1.10P2N2.

CVSS 3.1: 3.5 LOWCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.69% probability · 51th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: zte/zxhn z500 firmware · zte/zxhn f670l firmware
Source: psirt@zte.com.cn

References

http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013922Vendor Advisory
http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013922Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.